RSS feed for Risk management

Skip transcript: Video 2 Why is risk management important?

Video 1 What does ‘risk’ mean?

Interactive feature not available in single page view (see it in standard view).

2 The importance of managing risk

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Now watch Video 2 from the experts on why risk management is important.

Download this video clip.Video player: Video 2 Why is risk management important? >

Video 2 Why is risk management important?

Transcript: Video 2 Why is risk management important?

SPEAKER 1:

Risk management is important because it's all about intaking intelligent decisions and having the information to do so. If we don't make those decisions or we don't make them accurately, someone could get hurt, we could harm the environment, or we could lose money.

SPEAKER 2:

Risk management is important because it's really about helping people to be more successful. So we want to set out to try and achieve something. If we think about all the things that may happen that might stop us achieving something, or even help us to achieve more, it will help us to focus on those things, put some specific, timely actions in place. And then hopefully, at the end, we're more successful as a result,

SPEAKER 3:

It preserves value in the sense that let's preserve what we already have. So we're trying to manage all the risks that the organisation is facing, but it also looks to create value as well to make sure that you don't lose unnecessarily opportunities or you lose out to the competition.

SPEAKER 4:

Risk management does many things for us. If we're doing it effectively, if we're managing risks effectively, it makes us make better decisions. It gives us more transparency and actually lets us share transparency with others, which is just as important. It allows us to forecast things more credibly as well. People think that, well, if something makes more money or we do something faster, that's always a good thing.

Well, in particular complex organisations, it's not necessarily a good thing. It could just be- it could be the lesser of two evils, but it can have downsides as well. So there's many facets to it. But frankly, we're more effective as an organisation, as people.

SPEAKER 5:

Businesses have to make multiple decisions every day. Businesses are there for a reason. They have to either turn a profit, or keep quality product, or whatever it might be to keep their customers happy and consumers happy. As we said earlier, a risk is around uncertainty. So all businesses have an element of uncertainty. And the more you can understand what that uncertainty is and what measures you might need to put in place to manage that uncertainty, the better decisions that can be made as far as your business is concerned. So the management of risk, therefore, underpins good business decisions.

SPEAKER 6:

You look at people who manage risk well, people like Richard Branson and other entrepreneurs. What they look to do is they look to minimise the downside and maximise the upside, therefore getting the maximum possible return for something. On the flip side of that, you look at people who manage risk badly or where risk has been managed badly, and you can end up with some horrific and tragic incidents, things like Piper Alpha, things like Deepwater Horizon. Or in a business context, you can end up with massive frauds and scandals.

So recently, for example, there's been the Tesco accounting fraud which has wiped billions of pounds off their share price. So I think risk management has a dual purpose- firstly in improving the performance of the business, making it even better and the returns even better, but also minimising those downsides or those bad things that could happen.

End transcript: Video 2 Why is risk management important?

Show transcript|Hide transcript

Skip transcript: Video 3 Rolls-Royce timeline (Please pause the video when you need to, to ensure you can read through all of the text on-screen. A transcript is also available.)

Video 2 Why is risk management important?

Interactive feature not available in single page view (see it in standard view).

Risk management is considered so important that many professional disciplines are encouraged to manage risks as part of their professional code.

As a good example take a look at the ‘Guidance on Risk’ set out by the UK’s Engineering Council (2011). The guidelines are as follows:

Apply professional and responsible judgement and take a leadership role.
Adopt a systematic and holistic approach to risk identification, assessment and management.
Comply with legislation and codes, but be prepared to seek further improvements.
Ensure good communication with the others involved.
Ensure that lasting systems for oversight and scrutiny are in place.
Contribute to public awareness of risk.

Indeed all UK companies listed on the Stock Exchange are expected to apply effective risk management as part of their compliance with the UK Corporate Governance Code.

3 Risk in everyday life

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Risk is all around us. We take risks when we eat and drink, travel, enjoy hobbies, invest money and do many other things. Risk may be something you think about a lot when doing any of these things, or it may be something that never enters your mind. Take a look at the activity below and try to describe your approach to risk in these areas.

Activity 1 Considering risks in everyday life

Allow approximately 10 minutes

Active content not displayed. This content requires JavaScript to be enabled.

Interactive feature not available in single page view (see it in standard view).

Active content not displayed. This content requires JavaScript to be enabled.

Interactive feature not available in single page view (see it in standard view).

Active content not displayed. This content requires JavaScript to be enabled.

Interactive feature not available in single page view (see it in standard view).

Hopefully you will have taken the opportunity to think about your and others’ personal approach to risk, known as personal risk appetite, and appreciate how people can have different approaches to risk in different parts of their lives. For example, someone who skydives and likes travelling solo around the world may not like a lot of risk in their financial investments. But it is also true that some people are big risk-takers most of the time, and take a lot of risks generally, while some are risk-averse and avoid taking risks as much as possible.

Getting the balance right between when and how much risk to take can often be tricky. Taking too many risks, or one really big risk in a personal hobby may mean we get injured. In personal investments, taking more risks could be a good way to earn more money, but it is also a good way to lose money – balance is the key. In pensions, for example, young people are often encouraged to take slightly more risk in their investments, but people closer to retirement are advised to be risk-averse and take as little risk as possible.

4 Managing risk: a brief history of risk management

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

The word ‘risk’ is thought to derive either from the Arabic word ‘risq’ or the Latin word ‘risicum’. The two possibilities quite neatly combine to give us the meaning for the English term in this context. The Latin word originally referred to the challenge presented to seafarers by a barrier reef and so implied a possible negative outcome. The Arabic word, on the other hand, implies ‘anything that has been given to you (by God) and from which you draw profit’ and has connotations of a potential beneficial outcome.

A twelfth-century Greek derivative of the Arabic risq related to chance outcomes in general with no positive or negative implications. The definitions above can be combined to derive a concept of risk as being ‘an uncertain future outcome that will improve or worsen our position’.

There are two implied elements about this definition that should be noted:

it is probabilistic – the likely outcome can be assessed, but is not known with certainty
it is two-sided – the outcome may be favourable or adverse.

Strictly speaking, the ‘favourable or adverse’ aspect of the definition does not necessarily imply ‘symmetry’, where the ‘upside’ and ‘downside’ are of an exact equivalent magnitude. Indeed in many risk situations the outcomes may be skewed – for example, more ‘downside’ than ‘upside’.

The French word ‘entrepreneur’ first appeared in the French dictionary in 1723 to describe a person who organises and operates a business by taking a financial risk. Good risk management isn’t about not taking any risks: it is about taking the right risks where there is an appropriate reward. It is about protecting assets and adding value.

Risk is all around us, and always has been. In that regard it can be considered to have always been a part of human life, and even as a profession its roots go back a long time. Some forms of mutual aid existed in ancient societies and these are considered the forerunners of modern insurance companies, which are fundamentally reliant on risk-based assessments and decisions. Ideas of modern professional ‘risk management’ as a separate discipline grew from the insurance companies of the mid-twentieth century who sought more control over the risks they were insuring against, and branched out into other areas of loss-prevention in their companies, thereby reducing the levels of risk their own businesses faced in other ways than just insurance.

Today risk management is well recognised and widely practised and it takes many different forms. Some of this is driven by regulation – for example, Section 414C of the UK Companies Act, which is applicable to all companies incorporated in the UK, regardless of size, requires that ‘The Directors’ strategic report must contain a description of the principal risks and uncertainties facing the company’. Consequently, many organisations have recognised that value can be derived by managing their risks, reducing the probability of downsides and increasing the probability of upsides. In fact most organisations today have a Chief Risk Officer (or similar role) and many senior roles are, in large part, accountable for managing an organisation’s biggest risks. The Institute of Risk Management (IRM) indicates some of the potential careers open to risk professionals (Institute of Risk Management).

5 Business impacts

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

When risks do happen the impact can often have a serious effect on a business. Take a look at these case studies that describe some impacts of businesses getting risk management decisions wrong in different ways.

Remember to open these links in a new tab (right-click on the link and click on the option to open the document in a new tab or window) so you can look at them in relation to the course, and get back to the course easily.

Now take a look at Video 3, which is the Rolls-Royce timeline.

Download this video clip.Video player: Video 3 Rolls-Royce timeline (Please pause the video when you need to, to ensure you can read through all of the text on-screen. A transcript is also available.) >

Video 3 Rolls-Royce timeline (Please pause the video when you need to, to ensure you can read through all of the text on-screen. A transcript is also available.)

Transcript: Video 3 Rolls-Royce timeline (Please pause the video when you need to, to ensure you can read through all of the text on-screen. A transcript is also available.)

[Music playing]

1960: During the 1960s aircraft designers believed that supersonic aircraft would take over passenger services and that eventually subsonic aircraft would only be used for lower value, primarily cargo, activities.

1965: However, Juan Trippe, of Pan American Airways, believed that an economic shift was required and approached Boeing to build an aircraft nearly twice the size of anything then available.

With the technology available at the time engineers were also unable to look at double deck aircraft and so to create the necessary size widening the aircraft became the only choice.

This in 1965, under the direction of Joe Sutter, the design of the Boeing 747 began, however it would not be until February 9th 1969 that the aircraft would make its first flight and along the way there were some major hurdles that nearly brought about the bankruptcy of Boeing.

1966: The design relied upon the relatively new and as yet not fully understood technology of high-bypass turbofan engines.

General electric had pioneered the technology in military applications but had not yet developed a commercial offering. Their main competitor in the United States, Pratt and Whitney, were also working on developing this technology and, in 1966, agreed to develop the JT9D for the new Boeing aircraft.

However problems in the development of the JT9D delayed Boeing 747 deliveries to the point where up to 20 aircraft were complete apart from engine installation.

The Boeing 747 also required a completely new facility to be built.

The cost of building the plant and developing the aircraft meant the company had debts in excess of $2bn (a record for any company at that time).

The delays had meant that Boeing had to find more funding, with the hope that the gamble of a monopoly in the very large passenger market would provide the return the investors expected.

1966: In 1966 Pan American Airways’ competitors, American Airlines, recognised that they needed an aircraft that could rival the Boeing 747.

American Airlines approach Douglas and Lockheed to offer designs for a smaller aircraft (~300 passengers), still capable of long distance routes.

The newly formed McDonnell Douglas Corporation, where Douglas at the point of merger had been less than 12 months from failure, offered American Airlines the DC10 aircraft.

The DC10 shared much in common with previous Douglas aircraft, notably the relatively new DC8 and the programme was managed to a very tight budget.

1966: By contrast Lockheed hadn’t produced a civil airliner since the propeller driven Lockheed Electra, although it did have experience in producing large military transport aircraft.

Lockheed wanted to be part of the civilian market and so the Lockheed Tristar was created. The design philosophy had the aim of designing the best and most advanced product of the time, where the technology didn’t exist Lockheed designed and created it.

The cost of developing the necessary technology would result in a high purchase price for the Tristar.

1966: In the mid-sixties Rolls-Royce was extremely active in developing a number of engines, however this changed towards the end of the decade:

In May 1966 Rolls-Royce cancelled the RB178 programme, when it became apparent that the Boeing 747 would not be Rolls-Royce powered.

Before the end of the decade the UK had withdrawn from the Airbus consortium and the RB207 programme was cancelled.

However the company continued to develop the RB211 for the DC10 and the Tristar.

However, Rolls-Royce was developing these concepts on a fraction of the funding of its main competitors.

President Johnson: From mid-1967 until early 1968 Douglas, Lockheed, General Electric, Pratt &Whitney and Rolls-Royce went through many iterations of requirements, each increasing the primary requirements while keeping the costs down.

In February 1968 American Airlines announced it had selected the McDonnell Douglas DC10 as its preferred choice and that its preferred power plant was the Rolls-Royce RB211. By March 1968 President Johnson had received written protests from six senators and five representatives, from states that would benefit if a U.S. engine manufacturer was selected.

The U.S. Congress was concerned that the import of Rolls-Royce engines would result in a United States payments deficit of $3,800 million and the loss of up to 20,000 jobs.

McDonnell Douglas finally selected the General Electric CF6, a civilian derivative of the TF39 that had been developed in the early 1960s to power the Lockheed C5 Galaxy, as the power plant for the DC-10.

The McDonnell Douglas DC10 would take its first flight on the 29th August 1970, it would enter service with American Airlines on the 5th August 1971. The Lockheed Tristar would now become Rolls-Royce’s sole route to market in the widebody segment.

The Rolls-Royce RB211 was an innovative engine. The unique 3 shaft design promised a more efficient, compact and rigid engine, although it was more complex to design and maintain. In addition to this Rolls-Royce offered a promising advance in technology, a fan built from a carbon fibre material known as Hyfil, this would provide a significant weight saving over its titanium equivalent.

As early as 1967 the company knew that the project’s target of entry into service in 1971 was challenging. The project suffered a serious setback with the sudden death of Adrian Lombard, the chief engineer, and by the end of 1969 the RB211 was under thrust, over weight and unable to meet the fuel burn consumption targets.

In May 1970 the project suffered a further major setback when the much promised Hyfil material failed critical tests and thus the design would have to revert back to a more conventional titanium blade.

This design was also fraught with problems when it was realised that only one face of titanium billet possessed the right metallurgical qualities for the blade.

By 1970 the development costs were double those originally estimated and each engine would cost more.

1971: In Feb 1971 Rolls-Royce was placed into receivership. As the sole power plant for the Lockheed Tristar, and with Lockheed facing significant re-design work if the RB211 was unavailable it became a matter of national importance in both the United Kingdom and the United States that Rolls-Royce should remain viable.

The UK government nationalised Rolls-Royce, with US government guarantees for Lockheed loans that enabled the completion of the Tristar programme.

As part of the agreements new contracts were signed between Rolls-Royce and Lockheed to cancel late delivery penalties and increase the sale price of the engine.

1972: The Tristar’s first flight was in November 1970, but it wasn’t until April 1972, almost 18 months later and 6 months since the DC-10 had entered service, that the aircraft entered service with Eastern Airlines.

When the Tristar did start flying, and before it entered service, it was clear that it did not meet the performance expectations that had originally been laid out and much of this gap was down to the capability of the engines.

However, now under state control, Rolls-Royce’s focus was tightly focused on ensuring that it could deliver the engines required for entry into service. In parallel, but by contrast McDonnell Douglas and General Electric recognised that there was a market for a larger version of the DC-10 and were quick to develop and bring to market a more capable variant of the aircraft that could serve longer routes.

Eventually Rolls-Royce did develop an engine that improved the performance of the Tristar, but it was too late to gain the market share required and in the end only 250 Tristars were sold, when business case had been for around 500 aircraft, by comparison around 400 DC-10s were sold. The failure of the Tristar ultimately forced Lockheed to withdraw from the civil aerospace market.

The competition with the Tristar had also had an impact on McDonnell Douglas who could only afford to offer a modified DC-10, the MD-11, rather than develop a new generation of twin engine aircraft. Ultimately inabilities to provide an offering in the new twin engine era lead to the downfall of McDonnell Douglas.

1974: The possibility of a twin engine widebody aircraft was being discussed while the Boeing 747 was being developed. As well as Lockheed and McDonnell Douglas, in 1967 the British, French and West German governments agreed to develop the A300 Airbus.

By 1968 it was possible for the aircraft to use any of the three main engine manufacturers’ offerings then available.

By the end of 1968 it became clear that the Rolls-Royce offering, the RB207, was losing out to the RB211 in terms of concentration and effort and that limited funding at Rolls-Royce meant that both could not be developed in parallel.

The Airbus consortium thus switched their engine choice to General Electric CF6 engines that would be made in co-operation with French engine manufacturer SNECMA.

In April 1969 the British government withdrew from the Airbus venture, at which point the West German and French government agreed to each equally fund the programme, the UK firm Hawker-Siddeley remained a major subcontractor within the programme. On the 28th September 1972 the A300 was unveiled to the public, one month later it flew for the first time; 7 months after the Tristar went into service.

The aircraft entered service in 1974 and initially its sales were very slow due to the oil crisis, however 10 years later the aircraft had secured 26% of the overall market segment and a total of over 500 A300 have been sold, it was also certified to be able to accept either a General Electric or a Pratt & Whitney power plant.

End transcript: Video 3 Rolls-Royce timeline (Please pause the video when you need to, to ensure you can read through all of the text on-screen. A transcript is also available.)

Show transcript|Hide transcript

Video 3 Rolls-Royce timeline (Please pause the video when you need to, to ensure you can read through all of the text on-screen. A transcript is also available.)

Interactive feature not available in single page view (see it in standard view).

Now have a go at Activity 2.

Activity 2 Risks to scale

Allow approximately 10 minutes

Click on the link below to load this interactive activity. Place these risks on the scale provided based on your work experiences of taking risks. For example if you think that organisations should normally aim to make an aspect of their business (say, cyber security) ‘low risk’ then select ‘low’.

Discussion

Table 1

Low	Medium	High
Breaking the law	Investing in volatile countries, markets or financial products	New market technologies
Safety of employees	Recruiting and retaining talented people
Environmental harm	Bringing new products to market
Safety of products
Cyber security
Protecting key facilities from natural disaster
Changes to regulations, tariffs or access to markets caused by governments

Zero: While you might want ‘Zero risk’ for something (e.g. a zero risk attitude to employee safety) in practice the only way this can be achieved is to remove the risk completely, therefore in many cases achieving ‘zero risk’ is impossible.
Desire to take little risk: Although ‘zero risk’ is impossible, there are many areas where risk exposure should be minimised. These would typically be risks where we could harm people or the environment or break laws or regulations. However, there may be critical business activities that should not be exposed to high levels of risk: protecting facilities and IT might also be areas where risks are not wanted.
Ability to accept some risk: There will then be areas where some risk is acceptable in order to achieve goals. When investing in countries it might be desirable to operate in areas with high growth and easy access to the necessary resources, but it would be considered an unacceptable risk to operate in areas with high corruption and low ethical standards. Similarly in recruiting and retaining talent, taking the steps to obtain the best people is key but exploiting individuals or using labour practices that might be viewed as unfair would be an unacceptable risk.
Accepting high risks: There will be some areas where the company is prepared to take high risks. In bringing a new product to market, especially if the product is essential to the success of the company, the company may be willing to put a vast amount of investment behind the project. Similarly in investing in new technology, if a company believes the technology is a ‘game changer’ it may try to ensure significant capital is available, the stakes for not doing so may be too high not to invest (see Rolls-Royce or Kodak earlier).

Throughout this activity it is important to recognise that risks do not occur in isolation. This means that a company will have differing risk appetites across and even within its activities. For example it may have a high-risk appetite for introducing new technology, so will do everything it can to bring it to market, but because it has a low-risk appetite for breaking the law, ‘doing everything it can’ excludes breaking any laws.

6 Understanding and expressing risk

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

You can see from the case studies that a clear understanding of risk is important. Kodak did not appreciate the size of the risks that digital photography posed to them; the owners of Piper Alpha either did not appreciate or ignored the operating and safety risks of cost-cutting; and Rolls-Royce did not factor the risk of rising costs into their fixed-price contracts. But how best to understand and express these risks? This question will be addressed throughout the course, but for now, consider the following question:

Which is riskier – handling explosives on a building site, or driving to work?

More people die in road accidents than from explosions, so is driving the riskier activity? There are many things to consider here. One important thing to think about in this example would be the accident rate per activity undertaken, which gives you a better understanding of how likely you are to suffer an accident doing either activity. This is an assessment of probability.

However, it still does not tell the whole story. Imagine if the accident rate per activity were exactly the same for both activities. Would you rather suffer an accident while driving or while handling explosives? Your answer to this question concerns the impact of the risk event. The impact of an accident while handling explosives is more likely to be serious (probably death) than an accident while driving, which could lead to many comparatively minor consequences. To fully understand the risks involved you need to understand both the probability and the impact of the risk. This will be revisited when discussing assessments later in the course.

7 The risk management process

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

There are a number of formal risk management processes, which will be covered in more detail in Session 2. They are typically written at a high level and it is recommended that the detailed approach followed is adapted to fit the task. However, there is a set of commonly recognised process steps. In this case, and for the rest of this module, the International Organization for Standardization (ISO) 31000:2018 standard will be referred to.

Figure 1 ISO 31000 diagram

Skip transcript: Video 1 How do experts define Enterprise Risk Management?

The process is iterative and when performed properly has multiple feedback loops between the different process steps. Unlike many processes, the risk process can operate at any (and all) levels of an organisation, works for any activity and applies to all types of risk. You will explore each of these steps in more detail in the coming sessions.

Box 1 COSO and ISO 31000

There are many similarities between COSO and ISO 31000. They share many common principles. Both focus on identifying, assessing and treating risks and monitoring them on a regular basis. They also both focus on the importance of good governance and culture to enable good risk management.

The main differences stem from their backgrounds. COSO evolved from a focus on financial reporting, whereas ISO evolved from a quality management system focus – so has more of a process or quality system focus.

COSO therefore has a greater focus on strategic risks and loss prevention (i.e. predominantly threat (downside) risks). It is aimed at the board (and senior leaders) and focuses on controls as the main treatment activity.

ISO on the other hand takes a much wider scope, looking to work for all risks (threat and opportunities) at all levels of an organisation. It looks to understand the risks to all objectives.

The terminology used is similar (but not the same) so firms looking to apply both approaches should understand the differences and potential conflicts between the two.

8 This session’s quiz

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Check what you’ve learned this session by taking the end-of-session quiz.

Session 1 practice quiz

Open the quiz in a new window or tab then come back here when you’ve finished.

9 Summary of Session 1

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

You are almost at the end of Session 1 so it’s a good time to recap what you’ve covered and take a look at what you will cover in the rest of the course.

The main learning points that have been covered in this session are:

what is risk?
examples of the ‘real world’ impacts of risks
risk-based decision making
a brief review of the historical background to the emergence of risk management by organisations
an introduction to common risk management standards.

You have seen that there are different definitions for risk, but the one typically used in business is ‘the effect of uncertainty on objectives’.

You have looked at some examples of where risks have happened (from now on these will be called ‘incidents’) and the impact that this can have. You have seen that the ultimate consequence of bad risk management can be companies going out of business, catastrophic damage to the environment and even people losing their lives.

Because of these consequences certain professional bodies require their members to consider risks, and corporate governance codes place an onus on a company board to understand and manage risk.

You have taken a look at some of the day-to-day decisions people take that involve risk and noted that different people are prepared to take different levels of risks. This concept will be revisited in future sessions when you look at ‘risk appetite’ (the level of risk people are prepared to accept).

Looking forward: In future sessions you will dig more deeply into the different steps in the risk management process; you’ll explore ways in which to systemise this and build it in to the day-to-day running of a business; you’ll look at some of the behavioural factors that can cause things to go wrong; and you’ll hear from experts on their real-world risk management experiences.

Introduction

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

In Session 1 you started learning about risk management. It defined what is meant by ‘risk’, and discussed why managing risk is important, what happens when risk is well managed and what can happen when it isn’t. You learned about risk in everyday life and how different people choose to take different levels of risk.

In this session you will build on last session’s ideas by exploring ‘Enterprise Risk Management’ and start to think about applying risk management in an organisation. You will determine prerequisites for risk management, explore first steps, and focus on how to set a scope and framework for your risk management activities.

By the end of this session, you should be able to:

explain what Enterprise Risk Management is
understand risk appetite
describe the components of a risk management framework
produce a document that sets out the scope and context for activity (a Risk Management Plan, or RMP).

Now begin Session 2.

1 Enterprise Risk Management (ERM)

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

In Session 1, you considered big risks involved with events that had happened and had serious impacts on the affected organisations. For a long time, businesses have managed specific types of risks. A manufacturing firm would typically look at health and safety risks, a bank its credit risks and a hospital the risks to patient safety. But doing a good job of managing one set of risks does not mean that the organisation has a good grip on managing all of its risks: it does not mean that all of the risks to the ‘enterprise’ are being managed.

Increasingly organisations have recognised the value of understanding and managing all of the risks that they face – this approach is called ‘Enterprise Risk Management’. But what is meant by ‘Enterprise Risk Management’ (ERM)?

In response to a number of high-profile corporate failures (Enron, WorldCom, etc.) regulators have introduced standards that apply to large listed companies. The United States set up a commission (the Treadway Commission) which subsequently published guidance on the essential elements of risk management. This is commonly called COSO (Committee of Sponsoring Organizations).

This activity will help you to understand COSO’s definition of ERM.

Activity 1 COSO framework

Allow approximately 10 minutes

Look at the text from COSO and use the drop-down options to fill in the correct words.

Active content not displayed. This content requires JavaScript to be enabled.

Interactive feature not available in single page view (see it in standard view).

Now watch this video about how experts define ERM.

Download this video clip.Video player: Video 1 How do experts define Enterprise Risk Management? >

Video 1 How do experts define Enterprise Risk Management?

Transcript: Video 1 How do experts define Enterprise Risk Management?

rm_1_session2_vid03_erm

SPEAKER 1:

Enterprise risk management is really all about managing all of the risk within your organisational enterprise. It's about policies and procedures. It's about people, training, tools, and systems, and everything that joins together as a whole for an organisation. It's almost- in my head, it's almost like the governance wrapper that sits around all of the good risk management work that you're doing.

SPEAKER 2:

And it's about making sure that if you're sitting in one particular part of the company, we don't just think about the risks that relate to that part, but how do we look across what we would call silos and make sure we look at the whole picture? So if you're sitting in finance, for instance, then there may be certain risks relating to finance. But how do they relate to, for instance, when we're looking at the supply chain and people who are managing external suppliers?

And is it the fact that the finance team may be trying to keep the costs down, but the supplier teams are trying to make sure we've got good, quality products coming in? So enterprise risk management is about getting the right balance across the different parts of the company and getting the right solutions and the strongest solutions so that the company can be as strong and resilient as possible.

SPEAKER 3:

I've worked in many companies where the finance team won't speak to the human resources team, and the human resources team won't speak to the engineering team, and so on and so forth. And that information is kept within the confines of one part of the business or one function within the business.

I think enterprise risk management does well break some of those barriers, break some of those boundaries, shares that information, and makes sure that it's clear and available to the right people when they need it so they can make the best possible decisions to take the organisation forward.

SPEAKER 4:

Enterprise risk management, for me, is the umbrella that supports the management of the operational risks here, and dependent on the risk type- the management of the strategic risks here, and then starts to put linkages between the two. Now, it's not easy because, as I said, you've got to be able to try and compare like for like, and you've got to have a very good understanding of, well, if something happens down here, how might it affect this thing up there?

But that's really what enterprise risk management should be trying to achieve. It should be trying to get that line of sight across the whole business. And it's to do- and it is line of sight, is to do that early warning. Because if we can find something down here that's indicative of something potentially of a bigger thing that can affect a strategic objective, it's when it's going wrong down here at the control level, the operational level, that's the best place to be able to find it and sort it and do something with it, because it's the easiest place to deal with. What you don't want is it to be in the press. You've just fallen off the edge of a cliff. The CEO is just about to be hung. You really don't want thattohappen.

End transcript: Video 1 How do experts define Enterprise Risk Management?

Show transcript|Hide transcript

Video 1 How do experts define Enterprise Risk Management?

Interactive feature not available in single page view (see it in standard view).

2 Risk appetite

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

One key concept that is central to risk management – and which is referred to by COSO – is ‘risk appetite’. The appetite that an organisation has for risk reflects, among other things, its financial strength and also its culture for taking risks. Take a look at Video 2 to get an understanding of the factors that determine risk appetite.

Download this video clip.Video player: risk_appetite_picture.mp4 >

Skip transcript

Transcript

NARRATOR:

There are risks you want to take and risk you don't want to take, risks you cannot afford to take, and risks you cannot afford not to take. Risk appetite defines the level and types of risks that you're prepared to take in order to achieve your strategy. The aim for companies not to remove all risks but to ensure that the level of risk being taken is appropriate given the level of return being received, they are aiming to operate in their desired risk-or-return sweet spot.

Companies will typically start by understanding their maximum amount of risk that they are prepared to take. This is called their capacity. They will then set their appetite at a level below their risk capacity.

It is good practise to have trigger levels to give early warning signs if too much or too little risk is being taken. The company will then assess its current risk profile against their risk appetite and capacity. Let's look at an example of this.

Risk lower than capacity, more risk can be taken to increase returns. Risk between triggers, this is the desired range or sweet spot for risk taking and reward. Risk in appetite but above upper trigger. Level of risk would be escalated so that the action can be taken to reduce the risk level before appetite is exceeded.

Risk above appetite level. Immediate action needed to reduce the risk level. Risk above capacity. The firm is not viable. The level of risk exceeds the firm's capacity to absorb the risks. This clearly sets out the targets and measures and allows companies to take appropriate steps so that they can take their desired level of risk.

End transcript

Show transcript|Hide transcript

Skip transcript: Video 3 What does risk appetite mean?

Interactive feature not available in single page view (see it in standard view).

Now watch Video 3 to learn what risk appetite means for experts.

Download this video clip.Video player: Video 3 What does risk appetite mean? >

Video 3 What does risk appetite mean?

Transcript: Video 3 What does risk appetite mean?

SPEAKER 1:

Risk appetite- so it sounds a little bit like it's about how much can you eat. And actually, that's a really good description of appetite. It's how much risk can you take on as a company.

SPEAKER 2:

So risk appetites is one of these terms that I know has recently appeared in lots of material and lots of literature. If you google it, for example, you'll find pages and pages and reams and reams of information, much of which is quite confusing. For me, risk appetite is all about saying how much risk am I prepared to take. What level of risk do I want to take, and what level of risk is too much?

And for most businesses, that's set against the level of reward that you're intending to receive. So I think a great analogy here would be that the financial markets where the more risk you're prepared to take, the more reward you can get. So risk appetite there is about saying how much risk am I prepared to take, how much money am I prepared to lose in seekingreturns.

SPEAKER 3:

If you're dealing with a supply chain for an organisation, for example, you could say that, OK, if we're not happy with risk appetite, we could do something like purchase additional stock so that if we had some form of crisis, we could draw on that, certainly, in the short term.

SPEAKER 4:

So we can have, say, safety compared to financial. So safety- in the rail industry, it's a safety industry. Safety is paramount. We don't want to take any unnecessary risk around safety, so we have a really low appetite for any safety risk.

Financially, again, no business can not have a low appetite for financial risk because you've got to take risks to move the business on. But there's also a limit. You've only got a finite capacity financially. So there's still limits, but you've got- you'll take more risk. You're prepared to lose some money in order to gain somewhere else.

So risk appetite is just about trying to explain to the organisation there's some areas we do not want you to take any risk, and there's other areas where we do want you to take some risk. There are boundaries within them. But ultimately, don't do anything that's going to be risky there. But within reason, fill your boots. We want you to do something over there. And ultimately, risk appetite is- that's all it's trying to do.

End transcript: Video 3 What does risk appetite mean?

Show transcript|Hide transcript

Skip transcript: Video 4 What would be in a risk management framework?

Video 3 What does risk appetite mean?

Interactive feature not available in single page view (see it in standard view).

3 Why is an Enterprise Risk Management framework needed?

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

A key part of ERM is identifying how much risk you are prepared to take (your risk appetite). You have also seen that ERM is a process that requires board involvement and the involvement of other people in an organisation. Enterprise Risk Management reaches strategic, compliance, financial reporting and operational aspects across an organisation.

This wide-ranging scope of ERM means that many companies find it helpful to design a framework, wherein the different elements are complementary and supportive of one another. In the best organisations, risk management is built in to other activities rather than being a bolt on, and so their ERM framework is interwoven with other elements of the way they do business.

4 The components of a company-wide ERM framework

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

An ERM framework covers the whole organisation. It includes: process, tools, governance, measures and people, all underpinned by an appropriate culture. Take a look at the elements of an ERM framework.

First take a look at Video 4 and hear what the experts say should be in a risk management framework.

Download this video clip.Video player: Video 4 What would be in a risk management framework? >

Video 4 What would be in a risk management framework?

Transcript: Video 4 What would be in a risk management framework?

SPEAKER 1

So I think a risk management framework should include a policy, so how we're going to do things, the tools and training, people in place, and a governance structure as well so that we can monitor how we're doing against our policy.

SPEAKER 2

It needs to tell me very clearly what am I supposed to do, who is supposed to do it, strictly speaking. It needs to give advice on where does risks need to be communicated to in order to be addressed in the most effective way. And last but not least, it needs to give me a clear indication of how much risk is this company prepared to take in order to get a reward, not for the sake of it.

SPEAKER 3

I would expect, in a risk management framework, people who understand the key concepts around risk. They're comfortable in applying those. They're comfortable in raising risks, or shining a light on risk so that people are aware of them. I would expect there to be a degree of rigour in terms of how people are recording things as well because it's important for people to be able to look at, for example, key sets of data around risk to maybe backup or provide evidence to a case that they're making. So yeah, a timely awareness and raising of those particular risks, I think, is fundamental.

End transcript: Video 4 What would be in a risk management framework?

Show transcript|Hide transcript

Skip transcript: Video 5 An Enterprise Risk Management framework

Video 4 What would be in a risk management framework?

Interactive feature not available in single page view (see it in standard view).

Now have a look at Video 5, which covers an Enterprise Risk Management framework.

Download this video clip.Video player: Video 5 An Enterprise Risk Management framework >

Video 5 An Enterprise Risk Management framework

Transcript: Video 5 An Enterprise Risk Management framework

INSTRUCTOR

So in risk management framework needs to include all the things that are necessary for good risk management to take place. So really, importantly, there needs to be the right people involved. And those people need to have the right behaviours to encourage the right risk management conversations.

They need to be very good at helping to join different people together so that we can get that combined knowledge through the company. And we've got the best chance of putting the right things in place to be successful in that company. So that's the people aspect of it. We need a very clear and as-simple-as-possible process that is consistent wherever in the company you happen to be and recognised and understood. And alongside that, you need the right training as well. And this is hopefully what this kind of training will help people to understand about what is risk management, why is it important, how can you help good risk management take place?

We also need to make sure we've got the right tools that help us to do risk management. Now that's all about either consistent templates. So we're capturing the right kind of information. And we can learn from previous conversations about risk.

And we can make sure all the right elements of the process are happening. And it's also about having maybe the right software solution in place, which helps to make sure that the risk management activity that's happening is really adding value. And we try to remove any of the non-value added activities so that we can make risk management as lean and effective as possible.

We need the reporting framework, which means that the right people get to know about the risks so that the right things can be put in place. And really, importantly, we need the right culture of the organisation surrounding that framework to make sure that we can surface any risks that are there and put specific timely actions in place.

End transcript: Video 5 An Enterprise Risk Management framework

Show transcript|Hide transcript

Video 5 An Enterprise Risk Management framework

Interactive feature not available in single page view (see it in standard view).

Before moving on to the next section you should recognise there is no ‘one right way’ to do risk management and most of the standard guides and codes refer to the need to ‘customise’ the approach to fit each organisation. The example given in the next two sections relates to practice used in Rolls-Royce, but these will not necessarily work in whole or even in part in other organisations.

5 The Risk Management Plan (RMP)

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

This framework will be looked at again in later sessions, but for now consider a specific approach for the first risk management activity. The first task in setting up risk management for any new activity is to create a document called a ‘Risk Management Plan’ (RMP). The purpose of an RMP is to set a standard and ensure consistent and seamless application of risk. This step, referred to as Scope, Context, Criteria in the ISO 31000 risk management process, sets the tone for what will follow.

Figure 1 ISO 31000 diagram – Scope, Criteria, Context

RMPs can exist for small activities all the way up to risk activities for an entire organisation. An organisation-level RMP will be partly driven by the regulatory requirements, which will define some minimum requirements for governance and reporting. Listed companies in certain countries have to comply with corporate governance codes which may set a minimum requirement for the things the risk management system needs to cover. Corporate governance requirements are discussed further in Session 7.

6 The key components of an RMP

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Context and Scope: In many cases, the scope of the activities needing risk management will be broadly defined by something else – a project plan, a set of objectives for a team, or the work of an entire business. In any of these cases, it is still worth referencing the scope of the activities in the RMP, just so it is clear. In doing so, you may also need to consider:

Is there a budget for these activities? If so, what does the budget cover?
What activities are you responsible for?
What decisions do you have the authority to make (and which are outside your authority)?
What is not included?

At this point it may help to visualise a governance structure, or a work breakdown structure.

Figure 2 A governance structure used to scope a risk management activity

Skip transcript: Video 1 When to start risk management

Table 1 Key components of an RMP

Key components	Explanation
Roles and responsibilities	Who is accountable for risk management and are there any delegations of this accountability?
Risk reviews	How will they be carried out? When will risk reviews happen? Who is part of them? How will the output of them be communicated and to whom? Beyond that, levels depend on the size and complexity of the business or function.
Risk scoring scheme	The units of measurement and ‘graduations’ (these are, in effect, gradations of severity of a risk) by which risks will be measured and categorised. This is often referred to as a risk matrix or a Probability and Impact Diagram (PID). These concepts will be explored in greater detail in Session 4.
Communication and reporting	Understanding the organisational structure within the relevant business area is key to locating superseding RMPs and risk registers which you will need for escalations. But it is not just a matter of locating the superseding RMPs: it is also crucial to examine them and, in particular, to identify what level of risk(s) trigger an escalation of a risk management issue to these superseding RMPs.
Other logistical considerations	The RMP states where your risk register will be located.

While this may seem like a lot of information, in reality for many areas much of the work is defined once in the organisation RMP and reused within the organisation. This is because the risk requirements flow down from the centre of the organisation to business units and functions, and from business units to sub-business units and projects, with lower levels expected to comply with the requirements set out in the higher-level documents. This means that typically only those things that are different need to be described, meaning the RMPs are often quick and easy to prepare. For example, consider the RMP example below.

Remember to open this link in a new tab so you can look at it in relation to the course, and get back to the course easily.

RMP example

7 This session’s quiz

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Check what you’ve learned this session by taking the end-of-session quiz.

Session 2 practice quiz

Open the quiz in a new window or tab then come back here when you’ve finished.

8 Summary of Session 2

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

In Session 2 you have started to explore what risk management involves in an organisation. You have explored Enterprise Risk Management (ERM) and looked at what is contained in a risk management framework.

You have been introduced to the key concept of risk appetite, and considered how risk appetite is used in an organisation to define how much risk an organisation is prepared (or able) to take to achieve its objectives.

Finally, you looked at planning risk management activities, in particular who needs to be involved and how Risk Management Plans (RMPs) are created to ensure the right information is documented and the right activity takes place.

The main learning points that have been covered in this session are:

Enterprise Risk Management
risk appetite
the components of a risk management framework
the scope and context for a Risk Management Plan, or RMP.

Introduction

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Watch Video 1, which covers when to start risk management.

Download this video clip.Video player: Video 1 When to start risk management >

Video 1 When to start risk management

Transcript: Video 1 When to start risk management

SPEAKER 1

Risk management can scale up and down depending on the size of your business or organisation. What's suitable for a FTSE 100 business under the Corporate Governance Code for the UK is not suitable for a small, owner-managed business. It's about making sure you understand what those risks are that you face as a business and then taking action accordingly.

That may be there's a formal risk register, at a point that you need to go and maybe take some capital or some investment into the business, or it may be to avoid getting hit by incidents, you might have had experience with incidents in the past. And actually, you want to understand how to avoid those incidents in the future.

SPEAKER 2

It's always really challenging to know at what point do you start to put more deeper consideration of risk in place. Because what you don't want to do is stop the pace of those really exciting opportunities. But at the same time, it really comes back to what we call risk appetite. How much are we prepared to take on in terms of the risks that we face?

What can we afford to lose, potentially, if some of those risks happen? And how do we make sure that we have the right conversations happening at the right time so that we are moving forward to go for those really exciting opportunities, but at the same time, we're not doing that at any cost and taking all sorts of risks onboard?

Generally, I would have said if it's really thinking about ideas, that probably isn't the time to be putting really structured risk management in place. But as soon as you're starting to make some external commitments, you're starting to get stakeholders onboard, to give those stakeholders confidence that actually, you're thinking things through, you're thinking about what could happen, and any kind of events that could mean that those objectives that you really want to achieve might not be achieved, that's really probably the time to be putting some good, structured risk management in place. But it's really about the type of organisation and the type of people.

End transcript: Video 1 When to start risk management

Show transcript|Hide transcript

Video 1 When to start risk management

Interactive feature not available in single page view (see it in standard view).

In Session 1 you looked at some definitions of risk. Revisit these for a moment:

A situation involving exposure to danger, the possibility that something unpleasant or unwelcome will happen, a person or thing regarded as a threat or likely source of danger, a possibility of harm or damage against which something is insured, a person or thing regarded as likely to turn out well or badly in a particular context or respect, the possibility of financial loss.
OED source

So, as discussed in Session 1, a risk must have some degree of uncertainty. In the risk process identifying that uncertainty takes place in the risk identification phase:

Figure 1 ISO 31000 diagram – risk identification

Activity 1 Uncertainty statements

Allow approximately 10 minutes

For each question below select the statement which relates to a current business uncertainty (as opposed to a fact or a concern about a possible emerging risk).

Question 1:

Interactive content appears here. Please visit the website to use it

Question 2:

Interactive content appears here. Please visit the website to use it

Question 3:

Interactive content appears here. Please visit the website to use it

Question 4:

Interactive content appears here. Please visit the website to use it

Question 5:

Interactive content appears here. Please visit the website to use it

Answer

	These were the uncertainties (simple risk statements) all focused around tangible activities that the company presently faces	These were ‘facts’ that related to ‘incidents’ (either recent or historic) that may require action or give an insight into risks that may need to be managed	These are sometimes referred to as ‘concerns’ that are potential areas for risk where the concepts are broad and the company may want to undertake further work to understand the risks faced. These are often referred to as emerging risks. (See horizon scanning in Session 8.)
Question 1	There is a possibility that a key supplier may fail, leading to raw materials not being supplied.	In the last 5 years a supplier has only had a delivery issue once and this was due to factors outside of their control.	Within the next 10 years we will have to shift our supply chain away from the current raw materials to remain cost competitive.
Question 2	Because of strong competition the business might not win the contract with a big customer.	A competitor has just launched a new product ahead of us that is more advanced and it looks like it uses our intellectual property.	At some point a technology company will create an offering that will side step our main product range and could leave us as a niche player.
Question 3	A fire could break out in one of our facilities if we don’t take the right precautions.	Our main warehouse is built on a flood plain, there have been two floods in the town in the last 20 years.	Automation of the workforce is something we will have to manage in the next 10–20 years.
Question 4	There is a chance that the government may introduce new regulations that would limit how the company could trade.	There has been a coup in a country we operate in, leading to civil unrest in major towns and cities.	Climate change will impact the market for our product, how we produce and where we can sell.
Question 5	Sometimes our sales team make mistakes and this, if not properly managed, can lead to errors in the order processing system.	There is an error in our order fulfilment system that leads to some lines going to the wrong dispatch centre; we don’t fully understand the scale of this yet.	The internet of things will change how our customers place orders in he future.

By the end of this session, you should be able to:

construct a meaningful risk statement (Cause / Event / Consequence)
understand methods of identifying risk – brainstorming, interviews, checklists, PESTLE, SWOT
understand different types of risk
understand risk registers.

Now begin Session 3.

1 The basics of risk identification (What do I need to identify?)

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

There is a range of approaches for identifying risks, but first consider what it is you are looking to identify.

Activity 2 Identifying a risk

Allow approximately 10 minutes

Select the terms that, when set out in the boxes below, define the process of risk identification. Drag the correct terms into the three boxes.

Active content not displayed. This content requires JavaScript to be enabled.

Interactive feature not available in single page view (see it in standard view).

Discussion

The short answer is the Root Cause, the Event and the Consequence, or more precisely the Root Causes, Event and Consequences. The addition here is really important: where possible you need to understand all of the causes of a risk and all of the potential consequences. This is critical because only by doing this can you ensure that your treatments are comprehensive.

Root Causes – Root Causes are the elements that can lead to the event taking place.
Event – Events are the point at which control is lost but consequences have not happened.
Consequences – Consequences are the outcomes that can happen downstream of the event.
Hazard – A hazard is the set of circumstances in which the risk is present (e.g. there is a risk of explosion when filling a car petrol tank).
Controls – Controls are not part of a risk statement: controls are treatment of the risk. It is not uncommon for a control failure to be mistaken for a risk.
Incidents – An incident is a risk that has occurred. Incidents may provide ‘clues’ as to what risks may exist, but incidents may not provide the whole picture.
Concern – A concern relates to a set of circumstances that may result in a risk. However, they are often too poorly defined to allow for a risk to be created. Therefore further work is often required to establish the risk present.
Cost – Cost is not part of a risk statement, but it is often used as a way to measure risk.
Issue – An issue – similar to an incident – is a risk that has occurred, but typically may have more of an enduring nature (e.g. a fire (an incident) leads to a prolonged unavailability of computer servers (an issue)).

2 What should a ‘well written’ risk statement contain?

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

A risk must also have certain key elements, which generally are, as a minimum, root cause(s), an event and consequences. Recognising and identifying these elements is what constitutes a risk statement.

A root cause – This is the origin of the risk, the reason(s) the risk exists. As an example, consider the root cause(s) of a fire – a supply of oxygen, a source of heat and a source of ignition. One interesting method of drilling down to the root cause of a risk is to keep asking ‘why’ in response to the feedback on a question. This interrogative technique is called the ‘Five Whys’ technique and is attributed to Sakichi Toyoda, the founder of Toyota Industries.
An event – This is the risk itself, and normally the point where ‘control’ has been lost but the consequences have yet to occur. For example, the event for a fire is the fire breaking out, but no property being damaged or people harmed. In the business example the event will be a failure in awareness of contract liabilities.
A consequence – This is often described as the ‘so what?’ of risk management. These are the ‘events’ that occur as a result of the risk. Consequences should be measurable against the organisation’s objectives. The consequences for a fire may be damage to property, injury or loss of life, financial losses to repair and financial losses due to not being able to operate. It is important to note that a risk may have more than one root cause and more than one consequence. You need to capture all root causes and all consequences when identifying a risk and also recognise that the same root cause may drive more than one event and that the same consequences may arise from more than one event.

It is also important to identify risk ownership. In most cases the owner of the risk is the person who feels the impact of the consequences. However, this doesn’t mean that the risk owner has to personally complete all of the activities to treat the risks, which will be discussed in Session 5. There are often a number of other parties who support the risk owner to manage the risk.

Activity 3 Risk statements

Allow approximately 10 minutes

Put the following elements of some risk statements into the correct categories.

Click on the interactive to start selecting your answers from the drop-down options.

3 Different risk identification approaches

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Identification answers the question, ‘what are the areas of uncertainty?’

According to ISO 31000:

the purpose of risk identification is to find, recognise and describe risks that might help or prevent an organisation achieving its objectives. Relevant appropriate and up-to-date information is important in identifying risks.
The organisation can use a range of techniques for identifying uncertainties that may affect one or more objectives. The following factors, and the relationship between these factors, should be considered:
tangible and intangible sources of risk;
causes and events;
threats and opportunities;
vulnerabilities and capabilities;
changes in the external and internal context;
indicators of emerging risks;
the nature and value of assets and resources;
consequences and their impact on objectives;
limitations of knowledge and reliability of information;
time-related factors;
biases, assumptions and beliefs of those involved.
The organisation should identify risks whether or not the root causes are under their control. Consideration should be given that there may be more than one type of outcome which may result in a variety of tangible or intangible consequences.

ISO 31000

There are often many different ways to identify risks. Explore some of them now.

Click on the tools for more information.

Skip transcript: Video 2 How many times is the red file passed?

4 Styles of risk management

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

When considering their approach to risk management, organisations need to consider what operational approaches work for them. The next four subsections examine certain styles of these approaches.

4.1 Top down v. bottom up

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

All organisations will need to decide to what degree their risk register is derived from senior management ‘top down’ activity or from working level ‘bottom up’ activity. In reality, any risk register will be influenced by both. Some risks will be recognised at the working level of the organisation and may need senior management involvement to bring together the generic risk theme faced by the organisation, while other risks may be recognised at the top of the organisation and be mandated or otherwise directed down through the organisation. Organisational risk structures must allow for both approaches to be successful.

4.2 Standardised risk approach

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

An organisation may choose to define some risks that are present in large parts of (or the entirety of) the organisation in a standardised way that can be applied consistently across the organisation. The benefits of doing this are:

Creation of a consistent view of the root causes and consequences.
Greater awareness of the presence of the risk in the organisation.
Opportunities to reduce silos and seek best practice across the organisation.
Reduced waste in documenting risks.
It ensures risks are owned in the right place.
Greater potential for common treatment and sharing of best practice.

There are, however, some potential pitfalls to be aware of:

Business areas may adopt the risk without considering if there are any different circumstances.
If the completeness of the risk isn’t identified then the weakness persists across the organisation.
Reduced ownership and accountability can occur.
Users can become ‘blinkered’ to only the outlined set of risks and may fail to identify other risks.

4.3 Standardised elements – controls, root causes, consequence

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

As organisations grow their structures, employee numbers will also inevitably grow; however, the nature of the risks they face may not change at all or be similar enough to still be managed consistently. Consider the example of a fast-food restaurant chain: whether it is a chain of 10 restaurants or 100 restaurants, each restaurant will still have the same risk of fraud, business interruption (fire, flood, cyber security) or employee safety. Managing these risks in a consistent way allows for the pooling of knowledge and best practice, while reducing wasted effort.

To facilitate the creation of standardised risks, the organisation may go one step further and create standardised root cause, events, consequences and even treatments, which will be covered in greater depth in Session 5. In doing so, the organisation effectively creates a ‘catalogue’ of risk elements that can come together to create a set of risks. Technology permitting, a readily searchable database can be created to allow risks to be easily generated by those tasked with risk management within the business. Prior to this point, as part of risk planning, the organisation will have established a standardised approach to evaluate consequences (which will be covered in Session 4) allowing for a streamlined risk process.

4.4 Categorising different types of risk

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Many organisations find it helpful to put their risks into categories – for example, whether the risk event is internal or external to the organisation. It is also common to categorise by the type of risk (e.g. financial, operational, compliance, etc.). The reasons for doing this can generally be described as follows:

To allow the organisation to understand the types of risks it has at a macro level.
To consider priorities, if, for example, a particular categorisation appears with greater significance and frequency than others.
To consider combining efforts in particular areas (e.g. if common risk types emerge can common treatments be defined?). This is covered more in Session 5.
To engage company specialists on the particular risk types.

Many organisations find it helpful to create other categories based on root cause or other businesses themes, and will often have their own strategic objectives, principal risks or priorities to align with.

5 Documenting the risk (‘risk registers’)

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

It is common practice to capture all of the information about a risk in one place. The information will typically include the items listed below, some of which will be covered in greater detail in future sessions:

A description of the risk.
A risk statement describing the root causes, the event and the consequences.
An assessment of the impact and probability of the risk.
An identified individual to own the risk.
Treatment measures and their status.

The document or sets of documents in which all of this information is stored is commonly referred to as a ‘risk register’.

Activity 4 Risk register

Allow approximately 15 minutes

Using what you have learned so far – and particularly during this session – you can now start to create a risk register of your own. This can be based on the organisation where you currently work or on one where you previously worked. Click below to access the risk register document. You can save this and return to it later to add further details as you work through the course. Now create a risk register.

6 Human factor elements in risk identification

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

As with many other areas of life your view of matters is often limited by your perspective, and getting a diverse perspective on the risk means identifying risks that might otherwise remain hidden. The following activity demonstrates this.

Activity 5 Say what you see

Allow approximately 10 minutes

Now take a look at the video below and count the number of times the red clipboard is passed to another person.

Download this video clip.Video player: Video 2 How many times is the red file passed? >

Video 2 How many times is the red file passed?

Transcript: Video 2 How many times is the red file passed?

NARRATOR

Here’s a quick test of your powers of perception. There are two red files and two green files. Count how many times this red file is passed from one person to another in the next 20 seconds. Ready? Start counting.

[Music]

NARRATOR

OK, so how many times did they pass it? If you’ve got near to eight, you’ve done pretty well. But just how much were you paying attention? Watch again.

[MUSIC]

NARRATOR

You may have spotted that this giant mouse joined halfway through the game and then left again. Did you notice? This is called ‘inattentive blindness’ - not being able to see things that are actually there, which can be the result of having to think hard about one thing, and so not noticing something else.

End transcript: Video 2 How many times is the red file passed?

Show transcript|Hide transcript

Video 2 How many times is the red file passed?

Interactive feature not available in single page view (see it in standard view).

Discussion

In the first clip did you notice the mouse? No? Replay the clip and this time look for the mouse. Studies have found that about 30% of people who watch videos set up like this experiment failed to spot the mouse (or similar; the original test had a person dressed in a gorilla suit). The authors of the original experiment have concluded that most people believe they will notice something that is visible and distinctive but their experiments have shown that these intuitions can often be wrong. It is important to recognise these blind spots so that measures can be put in place to mitigate them.

Look at the picture and write down what you see here.

Figure 2

Discussion

In the picture in the second example did you see the old woman? Perhaps you saw the young woman? Take another look. The key thing to note here is that not everyone sees the same thing, and even different people looking at the same thing don’t always agree on what they see.

7 This session’s quiz

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Check what you’ve learned this session by taking the end-of-session quiz.

Session 3 practice quiz

Open the quiz in a new window or tab then come back here when you’ve finished.

8 Summary of Session 3

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

In Session 3 you have looked at risk identification and the importance of creating a comprehensive risk statement, covering all root causes of a risk, the risk event and all the consequences of a risk. You have also looked at risk categorisation and its benefits. You have considered the use of standardisation in the risk identification activity to support improved understanding of risks.

Moving on from the risk statement, you also looked at how individuals, groups and organisations can identify risks. The risk toolkit covered the use of a number of methods by which risk could be identified from simple ‘brainstorming sessions’ to more advanced risk ‘bow ties’.

Concluding Session 3 you covered best practice in documenting risks using a risk register and looked at some of the human factors involved in risk identification.

The main learning points that have been covered in this session are:

risk statement (Cause, Event, Consequence)
methods of identifying risk – brainstorming, interviews, checklists, PESTLE, SWOT
different types of risk
risk registers.

Introduction

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

In the last session you looked at how to identify a risk and considered the importance of understanding all of the root causes and the consequences of a risk. Thorough risk identification is a fundamental precursor to what will be covered in Session 4 – assessing a risk. Assessing the risk is the next step in the ISO 31000 standard, referred to as analysis and risk evaluation. In particular you will cover:

the different points at which risk can be assessed
the importance of time when making an assessment
how to assess risks in a quantitative and qualitative way
why using consistent units of measurement is important in assessing risk
why it is important to understand the impact and probability of each consequence
the iterative nature of risk assessment and risk treatment
complexity and connectivity of risks and how to deal with risks that have more than one consequence and with risks that can have the same consequences (aggregation).

Figure 1 ISO 31000 diagram – risk analysis and risk evaluation

By the end of this session, you should be able to:

understand the process of arriving at an ‘assessment value’ for the risk – scores and Probability and Impact Diagrams (PIDs) (gross, current, residual)
understand how to assess risk events (basic probability and impact assessment)
understand ‘basis of estimate’ – including the Programme Evaluation and Review Technique (PERT)
have an awareness of risk modelling – including Monte Carlo analysis and Schedule Risk Analysis (SRA).

Now begin Session 4.

1 Basic elements of risk assessment

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Risk assessment is the activity of understanding the extent to which potential events can affect the organisation’s ability to achieve its objectives.

In many situations, organisations do not have the resources to deal with all of the risks they face. By ranking them in relative order of importance, organisations can prioritise the treatment of risks. Risk assessment is the first step in prioritising risks.

Risk assessment can be both qualitative and quantitative, based on highly complex mathematical models or ‘gut feel’. Both approaches have their merits, but in its most basic form the aim is to understand what is the relative order or importance of the risks.

Figure 2 Probability and Impact Diagram (PID)

Skip transcript: Audio 1 Comparing risks

The most common approach to assess a risk uses two dimensions: impact and probability. This approach is usually displayed in a risk matrix (sometimes referred to as a Probability and Impact Diagram, or PID). It is also common practice to assign a value to each ‘cell’ in the risk matrix and this is commonly known as the risk score.

The risk impact(s) is the outcome of the consequences, which you examined in Session 3 when you looked at risk identification. For an organisation, risk impacts are often expressed in financial values, but may also be expressed in other values that are important to the organisation (e.g. health & safety, compliance, reputation). As an example, you may have identified a risk that a project may overrun with consequences that will cause late delivery and incur financial penalties. The impact would be the value of these financial penalties and a measure of the reputational impact of the late delivery.

The probability is the extent to which those impacts are likely to occur. The probability must be related to impacts otherwise the assessment is invalid; the two elements exist as one complete risk assessment.

It should be noted that other valid combinations of impact and probability may exist for the risk. To ensure correct risk assessment, organisations should set out rules defining how risks should be recorded. Some organisations use the ‘most probable’ approach, while others use ‘severe but plausible’. Whichever method is used, it must be consistent across the organisation to avoid potential confusion. Consider the simple example of the risk of fire. It may be equally valid to state that in the UK there are a large number of small fires, and therefore a ‘high’ probability of a small fire, but there are also a small number of very large fires and therefore a ‘low’ probability of a very large fire.

Some organisations may choose to look at additional measures, the most commonly used being:

Timing of impact – when the risk could occur.
Velocity (or speed of onset) – how quickly the risk could occur.
Vulnerability – how susceptible the organisation is to the particular impact.

It is important to set out some prerequisites before moving forward. If you consider risk management as an isolated activity then the measures used to assess risk can be tailored specifically to that activity. However, having a bespoke way to assess risks in each individual area in an organisation with two or more activities is problematic. Look at a simple example, where Risk Managers compare three risks, each assessed on a different basis.

Download this audio clip.Audio player: Audio 1 Comparing risks >

Audio 1 Comparing risks

Transcript: Audio 1 Comparing risks

MAN 1

I imagine a huge risk in IT right now. If it occurs the server will be out for two weeks. There is a 50/50 chance this will happen.

MAN 2

That's nothing. There is a risk in our finance centre that could cost five million pounds. But thankfully, there is only a slim chance of it happening.

WOMAN 1

But all of that isn't important. I'm managing a project for our customer that could be late by two weeks. And I think there is a 77% probability of this risk being realised.

WOMAN 2

OK, so which really is the biggest risk?

WOMAN 1

We don't know.

MAN 1

I don't know.

End transcript: Audio 1 Comparing risks

Show transcript|Hide transcript

Audio 1 Comparing risks

Interactive feature not available in single page view (see it in standard view).

As shown in the example above, without a common approach to scoring, with everyone using the same scoring variables and common units of measure, it is practically impossible to undertake meaningful risk management at a company level.

As discussed in Session 2, it is therefore a prerequisite to set out, across an organisation, a set of common scoring variables and units of measure that everyone uses. Only by doing this is it possible to compare risks from one part of an organisation with risks from another part and thus maximise the return for the effort invested in risk management. You can see an example of this under the scoring scheme in the RMP you can download from Session 2.

2 The importance of assessing all consequences

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

In Session 3 you saw how one risk can have more than one consequence. It is therefore important that you can understand and assess all of the consequences a risk can have. It is also important to consider how a consequence can evolve.

Risks change over time. It may seem obvious to say so, but over time the risk level faced for some risks may go up, while for other risks it may go down. Sometimes this is due to things within your control (e.g. tangible things you have done to alter the risk level); other times it may be due to a change in the external environment that change the level of risk faced. Consider the different points at which risks are normally assessed.

Download this video clip.Video player: asset_27.mp4 >

Skip transcript

Transcript

NARRATOR

The journey of a risk. We will run through the journey a risk takes through its life. Stage 1, target risk level. The target risk level is the level of risk that we would like to achieve. Stage 2, gross risk. This is the risk level and reflects the worst case. The gross risk level, so sometimes called inherent risk level, assumes any specific and significant controls and mitigating activities do not exist or do not work as intended. Stage 3, current risk. This is the level of risk we face today. It should take into account existing controls providing they are effective. A common mistake in assessing the current risk level is to include planned mitigation actions. This is incorrect and can lead to the risk being under called. Note that controls should only be taken into account if they are effective. Controls that are planned to be introduced and controls that have been shown to be ineffective should not be included in the assessment of the current risk level.

Stage 4, residual risk. This is the level of risk we will have in the future, once all of our planned treatment actions have been completed. The residual risk will also take into account existing controls and any controls that we plan to introduce. So the residual risk level will normally assume that all controls will be effective. To prevent under calling the residual risk level, only treatment actions that are fully funded and resourced should be taken into account. In certain circumstances, our risk treatment plans- so those that are funded and resourced- may not reduce the risk level enough. And we may still be operating with a higher risk level than planned. In this case, we would also record our target risk level. We would then look to explore what other treatment actions could be undertaken to reduce the risk level further. The risk treatment actions that move us from residual to target may not be funded or resourced.

Let's look at some common scenarios and the implications. One, gross risk level equals current risk level. We have no controls or the controls we have are ineffective. Two, current risk level is less than gross risk level. We have a set of effective controls that have reduced the risk level, so down to its current point. Three, current risk level equals residual risk level. There are no activities planned and funded to reduce the risk level. Four, residual risk level equals target risk level. Our planned and funded activities to reduce the risk level will get us to the risk level we'd like to achieve.

As we've seen, all risk levels change over time. Risk is dynamic. It changes. And because of this, each of the risk levels mentioned above may change. It may be that incidents have occurred that highlight that our controls are ineffective. So the current risk level increases. Or it may be that treatment actions are effective. So our current risk level reduces. However, the actions may not be as effective as we think. And so the residual risk level increases.

We also need to remember that external factors, often beyond our control, can change any of the risk levels. The only thing to remember is that, unless the risk can no longer happen, it is not closed. And even if the current risk level is at the target point, if the growth risk level is not, then you need to ensure that your controls remain effective. This is why assurance over controls is so important and why models such as Three Lines of Defence, as described in Session 7, are so valuable.

End transcript

Show transcript|Hide transcript

Skip transcript: Video 2 Road risk

Interactive feature not available in single page view (see it in standard view).

When assessing a risk you need to consider the level of risk and how this changes over time. This part of the process is iterative, where assessment of risks and treatment of risks need to be considered together. Risk treatment will be covered in more detail in Session 5.

3 How to go about assessing a risk

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

As stated earlier, the impact and probability must be considered in combination – not as discrete items – and the assessment must be made in line with any organisation guidance provided around expectations. In this section you will see how to assess a risk.

Firstly, consider the impact. Using the definition from Session 1, risk is defined as an uncertain event, but what most organisations are really interested in is risks that prevent them from achieving their objectives. The first step is therefore to understand the potential consequence(s) of interest to the organisation; this must be done bearing in mind that a risk can have more than one consequence. This may also mean in practice that some risks are discounted – those, for example, where the impact does not materially affect the company’s objectives.

Let us consider the risk inherent in driving a vehicle. While undesirable and something that should be avoided – both for the individual and for an organisation minor – ‘non injury’ accidents are of less concern than accidents that involve serious injury or fatalities. Therefore, if there are limited resources to manage the risk, as discussed in Session 5, the focus, individually and as an organisation, should be on reducing the risk associated with serious and fatal accidents. This approach, whereby a ‘single version of the truth’ is adopted, allows the organisation to fix the consequence(s) and focus on the root causes.

Activity 1 Road risks

Allow approximately 10 minutes

Now watch Video 2, which covers real-life examples of road risk, to explore how root causes will change our assessment.

Download this video clip.Video player: Video 2 Road risk >

Video 2 Road risk

Transcript: Video 2 Road risk

NARRATOR

Road risk is a generic term applied to the risk in all activities associated to the road, but not limited to the road as a workplace.

As with previous examples, the term road risk is very broad, and may cover everything from road maintenance personnel, to cycle couriers, car drivers, and bus or lorry operators.

It is important, therefore, to focus the risk into what is of interest or importance when understanding the risk. And in this case, it is the risk of injury, and ultimately, loss of life that the majority of work and information rightly focuses on.

Let's look at some examples of how information or data might drive a risk assessment in regards to injury and loss of life on the road.

In this example, we will focus on the UK road network. Comparing the split between urban and rural roads of the same type, whilst all rural roads have a lower accident per billion miles than their urban equivalents, the percentage of the total made up by fatalities is around three times that of urban roads, suggesting that accidents on rural roads are more likely to lead to fatalities.

There may be many factors that influence a difference, but considerations may include road design, width, surface quality, lighting, traffic type, landscape, and even emergency response times.

20% of all injury related accidents occur in a speed limit of over 40 miles per hour. So 50, 60, or 70 mile per hour. Yet 52% of all fatalities occur in these speed limits. The corresponding swing is in under 40 mile per hour zones, which account for 80% of all injury-related accidents, but only 48% of all fatalities.

Approximately 25% of driving activity happens during the hours of darkness. All factors being equal, injury trends should be in line with this. But that is not the case.

Over 40% of fatalities, 31% of serious injuries, and 28% of slight injuries occur at night. This indicates that more accidents happen proportionally at night, and those accidents are more severe.

As with the road location, discussed earlier, there'll be many reasons behind this. Visibility, moving from lit to unlit roads, tiredness, and type of traffic will all play a part in this shift between night and day.

58% of injury accidents happen at junctions, where vehicles must cross paths to continue their journey. When looking just at junctions, it is evident that T junctions, staggered junctions, and crossroads play a significant part in all accidents, a trend which persists with serious and fatal accidents.

Roundabouts, on the other hand, show a declining trend in severity, from an injury accident through to fatality. This may not be solely down to road design. Other factors, for example, location or road speed, play a part. But road design may influence outcomes.

Some of the factors described above, combined with others not covered here, provide a driving environment across the UK that is varied, which creates different outcomes in terms of the number of accidents, their severity, and ultimately, the number of fatalities.

On the roads of Lincolnshire, fatalities occur far more frequently per million miles driven than in any other county in the UK. Similarly, serious injury in London is again far more frequent per million miles driven.

Understanding underlying factors- so in Lincolnshire, long, narrow roads with large, agricultural traffic; and in London, the number of pedestrians and cyclists mixed with HGVs and buses that may be driving these trends- is an essential step for anyone assessing roads risk in different locations, prior to considering what treatment to undertake.

End transcript: Video 2 Road risk

Show transcript|Hide transcript

Video 2 Road risk

Interactive feature not available in single page view (see it in standard view).

Once root causes have been understood the next step is to ask how likely the consequence is to occur. It is an important point to remember that the aim is to understand how likely is it that the risk will lead to the consequence defined previously, because as stated earlier the probability and impact are coupled.

3.1 How to quantify impact

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

There are a number of different approaches that can be used to quantify the impact of risk. This section takes a look at some of the most common approaches and discusses their limitations.

Models – Financial models that calculate the impact are often used. These are particularly helpful where there is a history of information about the risk and how often it occurs. Models can then be constructed, based on historical observations, to predict the future level of risk. It is important when using models to know whether the model is being used to extrapolate (i.e. predict results beyond the data the model is based on).
Scenarios – Scenarios are similar to financial models but can be used to assess risks that are new and/or are yet to happen. The scenario will define a set of assumptions about the nature of the risks; these assumptions will then be used to assess the risk’s impact.
History – Impact of risks can be based on actual information on risks that have occurred. For example, last time the machine cost 10% more than forecast so the risk is future machines will cost 10% more than forecast.
Expert opinion – In certain circumstance there may be no historical information to fall back on. It may be that the venture or the circumstance is so novel than no comparable or relevant information exists. In such situations it is common to solicit expert opinion. It is recommended that, where possible, the assumptions made by the experts when giving their opinion are captured – these can then be revisited over time to ensure the assumptions (and therefore the assessment) are still valid.

Best practice is to be able to show how the assessment was arrived at and, in particular, what assumptions have been made.

3.2 How to deal with risks that are on a continuum

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

As discussed earlier, a number of risks operate on a continuum. These risks exist as a range of impacts that can simplistically be described as there being a much higher probability of a low impact and (hopefully) a much lower probability of a very large impact. One approach, already highlighted, is to ensure that the organisation adopts a ‘single version of the truth’ where everyone is expected to report one scenario; however, with more complex risks, where there are many root causes, this may not be appropriate.

Consider a real-life example – earthquakes – to understand the importance of examining the distribution (or pattern) of combinations of risk probability and risk impact.

Being specific about consequences is important: whilst there are thousands of small earthquakes globally, there have only been around 500 since 1900 that have exceeded 3 on the Richter scale. These are shown in Figure 3

Figure 3 Number of earthquakes exceeding magnitude 3 since 1900 based on number of fatalities

Of those 500, in approximately 17% of cases there were no fatalities, and in a further 34% of cases there were fewer than 10 fatalities, meaning that in 51% of earthquakes there were few fatalities. In 15% of earthquakes there were 1000 or more fatalities. However, the view can change depending on location in the world (and the data chosen to use). Figure 4 shows just the data from 1900 to 1950.

Figure 4 Number of earthquakes exceeding magnitude 3 between 1900 and 1950 based on number of fatalities

If you just look at data up to 1950, then 37% of earthquakes killed in excess of 1000 people, with people in the ‘developed world’ being the most impacted. Perhaps because of better recording or perhaps because of greater earthquake activity, but the picture for the second half of the twentieth century and early twenty-first century is very different, as shown in Figure 5

Figure 5 Number of earthquakes exceeding magnitude 3 since 1950 based on number of fatalities

Skip transcript: Video 3 Risk aggregation

Since 1950, earthquakes in the developed world where more than 1000 people die make up just 2.8% of the total. Worryingly for those in the developing world, while earthquakes that kill over a 1000 people since 1950 in these regions represent 4.2% of the total, earthquakes that kill over 10,000 people represent 2% of the total. Thus very large-impact earthquakes in the developing world are almost as prevalent as a lower-impact event in the developed world. A large portion of the difference potential is due to controls, which will be covered in treatment.

These risks and their impacts are often shown as a distribution. In such cases it can often be very important to understand the shape and nature of the distribution; in certain circumstances it may be appropriate to capture multiple pairs of probability and impact to properly describe the risk faced. This can prove to be particularly important where different treatment approaches will be required. There will be more on this in Session 5.

Distributions such as these are often used in the financial services industry – for example, in credit scoring. In this area, a plot of the distribution of credit scores versus loan default rates can be used to assess the risk of default based on approving loans relative to a certain credit score.

3.3 Risk aggregation

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Now consider a simple example to explore what the term risk aggregation means. Take a look at the video below and see how the experts assess risk.

Download this video clip.Video player: Video 3 Risk aggregation >

Video 3 Risk aggregation

Transcript: Video 3 Risk aggregation

[Music playing]

Case 1: Business A, B and C all use the same IT system. The IT function believe there is a 50% chance that the IT system will fall over for one month next year and it will cost £100k to repair it if it breaks. What is the impact of the risk?

Answer: Based on the information provided, we have no way of knowing! What we need to understand is what the impact on each of the businesses is.

So we go and ask them and they say a one month outage would cost Business A £10m, Business B £5m, Business C £8m.

Answer: It depends where you sit. For IT it is £100k, for Business A it is £10m. But for the business as a whole it is £23.1m (10+5+8+0.1).

Because all of the impacts result from the same root causes (the failure of a common IT system) this is the total impact to the organisation. It is therefore very important to understand all of the impacts that flow from the same root cause to allow the impacts to be added up (aggregated).

Case 2: In some instances we may have several risks that lead to the same consequence. To avoid double counting (counting the risk twice) we bring the risks together by combining their likelihoods. Let’s look at a worked example.

Andrews Aerospace has three risks that could prevent them selling products to a major customer; Customer X.

Risk 1: An outage at the European factory would prevent products being made for Customer X. This has a probability of 5% and an impact of £20m.

Risk 2: Export licenses cannot be obtained for the Andrews products preventing them being sold to Customer X. This has a probability of 10% and an impact of £20m.

Risk 3: Customer X buys the product from one of the Andrews’ competitors. This has a probability of 15% and an impact of £20m. Note: The impact of the risk is £20m (the expected sales value to Customer X) for each of the risks.

Because the impact of each risk relates to the same portion of revenue we need to aggregate the probabilities, this is because once one risk has happened the impact of the other two risks is zero (as the sales to Customer X have already been lost). We do this as follows:

The probability that each of the individual risks don’t happen = 100 − probability that the individual risks happen. So the probability that risks don’t happen are:

Risk 1: 100% − 5% = 95%

Risk 2: 100% − 10% = 90%

Risk 3: 100% − 15% = 85%

Therefore the likelihood that none of the risks will happen is: 95% * 90% * 85% = 72.6%

Therefore the likelihood aggregated risk is 100 - 72.6 = 27.3%

End transcript: Video 3 Risk aggregation

Show transcript|Hide transcript

Skip transcript: Video 4 Dealing with undefined risk

Video 3 Risk aggregation

Interactive feature not available in single page view (see it in standard view).

3.4 Using mathematical models

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

In certain cases it may be useful to aggregate the impact from multiple risks, with unrelated root causes, each with their own impact and probability. A common reason for doing this is on large projects to look at both potential schedule and financial impacts, and ensure that sufficient funds or contingency (time and money) are put aside to deal with the risks.

The approaches used to assess these risks can be quite advanced and are beyond the scope of this course. They are usually performed by experts using specialised computer packages. The information below outlines common approaches that you may come across.

Analysis type	Description
Monte Carlo	A mathematical model (sometimes called a stochastic model) based on a repeated random sampling to obtain a numerical value. Results are numbers. ‘Simulations’ are then brought together to give a statistical probability of a particular outcome. Results are often presented as ‘p’ values, denoting how statistically likely a particular outcome is.
Strategic Review Analysis (SRA) or Programme Evaluation and Review Technique (PERT)	This is an approach to understanding the likely variance to a schedule. Like the Monte Carlo, this is a mathematical simulation. Each task is typically give three values (often called a three-point estimate) where the values relate to Shortest, Longest and Expected time to complete. Multiple ‘iterations’ are then run to present the statistical probability of a particular outcome.
Expected Monetary Value (EMV)	EMV is calculated by multiplying the impact of the risk by its likelihood. For example, if the impact of a risk is £10m and the likelihood is 50% then the EMV is 10 × 0.5 = £5m. This can be helpful if there is a group of independent (unrelated) risks where the impacts and likelihood are similar. This approach is often used for calculating contingency funds for projects. Care should be taken, however, where there is a small number of risks, where the risks are inter-related and where there is a number of large, but unlikely risks. Like most risk modelling it is recommended that you engage an expert.

It should be remembered that as with all calculations, these models are only as good as their inputs. Moreover calculations, if assumptions are not made clear, can be misleading. Often end users may not understand what a ‘p’ value is. Furthermore, the shape of the distribution may be important to understand, and, finally, people may believe that the output is more trustworthy simply because it has been put though a complicated model, irrespective of the quality of the underlying information.

3.5 Human factors in risk assessment

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Risk assessment is often far from an exact science and it is important to be aware of some of the behavioural factors that can be at play. Here are a few examples:

When assessing risks that are highly uncertain or have not happened before there is often little or no known empirical data on which to base assessment. In these cases there can be a reliance on expert judgement.
Judgement, of course, can be subject to bias. For example, recent events may skew our perception of the probability of a risk; moreover, things that have happened to people personally (or to people they know) may be perceived as more likely to happen than they really are.
Perceptions and attitudes to risk may also skew our perception and assessment.

Best practice is to involve multiple people and to document the basis of estimate and the key assumptions that have gone into arriving at this estimate. In this way the key assumptions can be understood and, where necessary, tested.

Take a look at the video below, which looks at dealing with undefined risk.

Download this video clip.Video player: Video 4 Dealing with undefined risk >

Video 4 Dealing with undefined risk

Transcript: Video 4 Dealing with undefined risk

SPEAKER 1

Risks evolve day to day, year to year. And they often evolve without expectation. So I've certainly experienced in the past, working in other industries that are heavily regulated, that all of a sudden, what you thought your risk was one day changes, because the government maybe have put out a statement, or it's an election year, and people's priorities change. So there needs to be a regular review of risks to ensure they're still relevant and to ensure action and treatment plans are still going to get us to where we expect to.

It might be that our risk appetite changes in the future or what we're planning to do was unachievable. At that point, we need to stop and re-baseline where we are and where we're trying to get to.

SPEAKER 2

All you can do is make the most logical assumptions and think of a number of scenarios. So we tend to use scenario analysis and assumptions analysis. So we think of, well, if this happens, what would that result in? If this happens, what might that result in? So they're difficult risks to quantify. They're definitely difficult risks to quantify.

But it's just about trying to think of, well, what would be the impacts in these different situations, in these different outcomes. How might they impact us? And then you can start to think about, well, which ones of those- again, tolerance appetite- do we want to put some preparatory measures in place so that if that happens, we can switch easily, and we've done the preparation. And that's all you can do, because ultimately, it's out of your control. But that's how you need to handle it.

SPEAKER 3

I think some risks are quite hard to quantify, quite hard to describe. And I think some of the potential outcomes of those risks are equally hard to quantify. So I think with that type of risk, it's important to engage with as many stakeholders as possible, both inside an organisation and, indeed, outside an organisation. But ultimately, I think it's about having a healthy understanding that, because you can't call out all of the consequences of a given risk, it's about being prepared, then, to respond to these as and when they happen. And by that, I mean by having effective incident management and ultimately crisis management frameworks in place.

SPEAKER 4

So some risks, by their very nature, are difficult to define. Sometimes they move. They change shape, for want of a better term. And particularly, business risks generally happens with things that are more nebulous or cloud-shaped in their form. But one example might be the fact that your business might be involved in government procurement, and your projects might be put back on a regular basis, or an irregular basis, or may be cancelled entirely.

This is something that's very difficult to actually have- work to a degree of uncertainty, to forecast forward, and everything else. So there's a few things, really, one of which is these sort of risks just need more effort. They need more regular review to make sure that something significant hasn't changed within them, either the risk itself, or the market, or whatever the risks- whatever sits around the risk, should I say. So that's one aspect. The other aspect is to start trying to look at it in a slightly different way, optioneering of sorts.

So for example, if you have a client who's always a very long lead times before things happen, and may not happen, or book forward, or whether, you might think about, actually, well, what else can I put into- how can I add certainty to this position in the market? And that might be going for a slightly different market. That might be smaller amounts of work, but with a quicker turnaround time than putting all this upfront investment and having that such a degree of uncertainty at the end.

End transcript: Video 4 Dealing with undefined risk

Show transcript|Hide transcript

Session 4 compulsory badge quiz.

Video 4 Dealing with undefined risk

Interactive feature not available in single page view (see it in standard view).

4 This session’s quiz

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Now it’s time to complete the Session 4 badge quiz. It is similar to previous quizzes, but this time instead of answering five questions there will be 15.

Remember, this quiz counts towards your badge. If you’re not successful the first time, you can attempt the quiz again in 24 hours.

Open the quiz in a new tab or window then come back here when you’ve finished.

5 Summary of Session 4

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Session 4 has focused on risk assessment. You have discovered that while there are many factors that can be used to assess risk, probability and impact are of greatest importance. To illustrate probability and impact you have covered the use of the PID diagram.

In discussing earthquakes and road risks you should now recognise that it is essential to understand what the risk’s consequences of interest to you are and how these come about (the root causes) in order to correctly assess the risk. You should also now understand that everyone in an organisation must assess in a common way for there to be effective risk assessment across the organisation.

You were introduced to the use of mathematical models in risk management, a subject that is too large to be covered sufficiently here. If you found this an area of particular interest then you could research opportunities to find out more. Finally the session closed by considering some of the human factors involved in risk assessment.

The main learning points that have been covered in this session are:

the process of arriving at an ‘assessment value’ for the risk – scores and Probability and Impact Diagrams (PIDs) (gross, current, residual)
how to assess risk events (basic probability and impact assessment)
‘basis of estimate’ – including the Programme Evaluation and Review Technique (PERT)
risk modelling – including Monte Carlo analysis and Schedule Risk Analysis (SRA).

You are now halfway through the course. The Open University would really appreciate your feedback and suggestions for future improvement in our optional end-of-course survey, which you will also have an opportunity to complete at the end of Week 8. Participation will be completely confidential and we will not pass on your details to others.

Introduction

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

In Session 5 you will build on the learning from previous sessions to consider probably the most important part of risk management, referred to in the ISO diagram as risk treatment.

Figure 1 ISO 31000 diagram – risk treatment

You will underline some of the concepts discussed in previous sessions, in particular risk appetite and risk assessment, and you will consider the most common approaches to risk treatment, including:

controls
actions
risk transfer.

By the end of this session, you should be able to:

have an overview of treatment
understand treatment strategies
understand an introduction to mitigation through action
demonstrate knowledge of an introduction to controls
understand assessing treatment effectiveness
produce an example of a treatment plan.

Now begin Session 5.

1 Risk treatment overview

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

All risk treatment should be related to risk appetite (discussed in Session 2). Risk treatment is the term applied to ‘doing something’ about a risk, essentially the phase of risk management that delivers value to the organisation. Without effective risk treatment, risk management has little benefit. Risk treatment is mainly about seemingly obvious business activities: identifying options, evaluating them (will they reduce the risks and are they value for money?), selecting the best option and then making sure it is implemented.

At all levels, the organisation, through its risk management processes, must decide whether there is a business case for treating certain risks, based on a number of factors:

What level of risk are you prepared to accept (risk appetite)?
Is the current level of risk lower than the appetite?
What measures can be taken?
Are these measures affordable?
Can the risk be accepted without further action?

2 Treatment options

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Options for risk treatment can be wide ranging, from changing the consequences or probability, removing the risk source, changing plans to avoid the risk altogether or accepting the risk (and making provision for it happening). Risk treatment is an iterative process, linking with other parts of the risk management process.

The figure and table that follow will recap some key definitions on the life cycle of a risk.

Figure 2 The iterative approach to treating risk

Figure 3 The life cycle of a risk

Skip transcript: Video 1 Risk treatment

Table 1 The life cycle of a risk

Type of risk assessment	Definition
Gross (also known as Inherent)	The worst case: the level of risk assuming existing measures (e.g. controls) don’t work as intended.
Current	The level of risk faced today. When assessing the current risk level you need to understand: What measures are already in place that reduce the level of risk? How do you know that these measure are working properly?
Future	The level of risk you will face in the future; this is commonly referred to as the Residual and Target risk level
Residual risk	The level of risk once all risk treatments have been completed. Good practice is to only take into account treatment activities that have been fully funded and resourced, as many companies find that without funding and resource, their best laid plans don’t happen! This leads to a potential further level of risk, the target risk level. This is the level of risk you want to take and is linked to risk appetite.

So there are potentially four levels (Gross, Current, Residual, Target) of risk that you may wish to assess. Often, however, things are simpler. Consider a few examples.

Residual risk = Target risk. On many occasions a company will fund all of the necessary treatment activities such that the level of risk faced once all treatment activities are completed will be the same as the level of risk they would wish to take, and therefore their residual risk is the same as their target risk
Residual risk = Target risk = Current risk. Furthermore, once a company has completed all ‘actions’ to reduce the level of risk, they may find that their current risk level is the same as their residual risk level, which in turn is the same as their target level. Remember, it is not the case that the risk can no longer happen: rather, based on the current controls (and assuming they are working effectively), the agreed level of risk is taken.

There is one further point to highlight, which is as circumstances change so can the risk level. This could be driven by things inside an organisation, as well as factors outside the organisation, it could be that new information is found that changes our view of a risk, or that technology changes change the nature of the risk. It is for this reason that risk assessment should be regularly revisited. Many organisations ensure there are links between their risks, the audit and assurance findings and their incident management processes for precisely this reason, as this gives them clear and early notification if their risk level is changing.

3 Treatment strategies

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Traditional risk management teaching suggests there are four different ways you can react to a risk:These will be explored in the following sections at the links below.

3.1 Acceptance

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Acceptance is when the organisation consciously (fully aware) accepts the risk and decides to do nothing. This course of action may be because the organisation, after having assessed the risk, believes the size/scale of the risk is small enough that no action is warranted (i.e. the risk is within its risk appetite). Alternatively the risk may be at the other extreme for the business, whereby the organisation can do nothing to change the risk but decides that the organisation still wants to operate with this risk. In this situation the organisation may be changing its risk appetite or would need to accept that it is operating outside of its agreed risk appetite.

It is the people accountable for the overall viability of the organisation who would have to accept the risk(s) that exceed appetite. Those decision makers should be clear about what risks they have accepted and the consequences of the decisions they make.

The decision not to mitigate a risk any further (see Section 3.4) means that you are accepting the current risk level. It does not mean the risk has gone away and can no longer happen.

Good practice is to link your current risk level to your financial forecasts so that the current level of risk is properly accounted for. You should not link your forecasts to your residual risk level, as the residual risk level has yet to be achieved.

3.2 Rejection

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Rejection is when the organisation decides that continuing to take the risk is untenable so rejects the risk. In this situation the organisation may need to take steps beyond just formally rejecting the risk, which may mean ceasing projects, stopping work or withdrawing from business segments. The decision to reject a risk must be carefully weighed up against continuing to take the risk, balancing the opportunity against the threat. An organisation’s risk appetite will play a part in whether it rejects a risk.

Rejecting (or avoiding) a risk may be the best strategy if the consequence of the risk is too severe for the organisation to bear or the costs of avoiding the risk are unacceptable, either in terms of the mitigation costs or the lost opportunity to the business. If the consequence of the risk is greater than the organisation’s risk capacity then rejecting (avoiding) the risk may be the only viable course of action.

In practice, rejecting a risk may involve not bidding for a new contract (e.g. companies wishing to avoid corruption risks may choose not to do business in countries with a high risk on the corruption perceptions index). Certain companies may exit entire countries or industries in a bid to avoid certain types of risks.

In certain industries risks are avoided in their design, either through removal of dangerous materials or through designing equipment to be ‘inherently safe’ (i.e. being able to withstand conditions in excess of those permissible).

3.3 Transfer

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Transfer is a specific type of mitigation (see Section 3.4) whereby the organisation transfers the entirety or an element of the risk, usually through a financial instrument, to provide some level of protection to the organisation.

There are several common forms of risk transfer, the most common of which are:

insurance
hedging
contractual terms and conditions.

In the first two instances the costs of a significant (but usually low probability) risk are taken by a third party, usually in return for a fee.

In the case of contractual terms the organisation may, knowingly or unknowingly, pay a higher price for the goods or services because of the level of risk assumed. In each of the three cases outlined above, the transfer of risk is normally done by experts, and as such this will not be covered further.

There are, however, some considerations to be aware of when practising risk transfer. In the case of insurance, while it can mitigate financial risks it cannot, in most instances, mitigate reputational risks; moreover, payment of insurance may be delayed, not paid in full (if the organisation is partly at fault) or, in extreme circumstances, the insurance company many not have the resources to fulfil its obligations.

The same risks are true of contractual terms and outsourcing. Passing on all liabilities to suppliers may give the illusion that risk has been fully transferred, but if the supplier is unable to honour their financial liabilities in full it may file for bankruptcy, and the impact would then fall back on the original organisation. Furthermore, assuming that risks relating to poor quality or poor HR practices can be transferred to suppliers can be difficult to manage in practice and require a high degree of oversight.

Download this video clip.Video player: Video 1 Risk treatment >

Video 1 Risk treatment

Transcript: Video 1 Risk treatment

SPEAKER

I have seen really good examples where we've put everything in that we could possibly can to manage a risk. And we've had to rely on insurance, basically. So you think about a flooding of a building. And flooding the building means that some of your technology is gone. Your people haven't been able to get into work but you still need to pay them. You've got the business not operating. It's not been able to do what it needs to do.

And insurance basically provides the kind of the loss, the clawback of loss to enable the business to carry on operating because most of that would if you didn't have insurance, that would mean that perhaps the business would have to close. People would lose their jobs. Customers wouldn't get the service or the products they wanted. But actually, insurance allows you to kind of get a little bit more money- get the money in. And I think it's always a really good way of transferring risk to another party. So it's very important no matter the size of the organisation, whether you're very small or very large, that you have very good insurance for your the risk that you can insure for.

End transcript: Video 1 Risk treatment

Show transcript|Hide transcript

Video 1 Risk treatment

Interactive feature not available in single page view (see it in standard view).

3.4 Mitigation

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Mitigation is when the organisation takes steps to actively manage the risk (do something about it). This can be in the form of actions, controls or plans put in place to take action in the event of the risk actually taking place (known as fall-back or contingency plans). Mitigation may be put in place to retain a risk at its current level of assessment, especially if the organisation is satisfied that the risk is currently at an acceptable level, or alternatively actions may be implemented to reduce the level of risk to a level that the organisation finds acceptable. Mitigations are things that change the impact and/or probability of a risk.

Risk assessment (covered in Session 4) will determine the priority for treatment, with higher-impact and higher-probability risks being prioritised for treatment. The organisation may decide to classify its risks in order to draw attention to the highest-priority risks and consider how risk information is disseminated throughout the organisation using risk escalation.

Risk mitigations will usually be collectively referred to as a risk treatment plan. Consider in more detail the two most common types of risk mitigations:

actions
controls.

You have now looked individually at how ‘actions’ and ‘controls’ treat, or mitigate, risk. However, this is not the complete picture. To effectively mitigate risk, both ‘actions’ and ‘controls’ must be used together systematically to achieve the best outcome for an organisation.

Here is an example from risk management that uses risks and controls: UK National Risk Register.

4 Mitigation through action

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

If the current level of a risk is higher than your risk appetite then an action plan should be developed to reduce the level of the risk. Good action plans possess certain characteristics; these characteristics can best be described by the acronym SMART.

The definition provided uses ‘assignable’ for the A of SMART; this is relevant in the context of risk treatment because risk treatments generally need to be owned to be operating and effective. However, other examples have the ‘A’ representing ‘agreed’, meaning everyone agrees to the action being undertaken. In the sense of risk management this is misleading because there may be actions that an organisation wishes to take that people don’t agree with but none the less will be undertaken.

Here is another OpenLearn course that covers SMART in more detail. (Note that this example uses ‘achievable’ rather than ‘assignable’.)

Actions can either reduce the probability or the impact (or both) of a risk. Because many risks have more than one root cause it is important to understand which root causes and which consequences are being treated by the action plan and which are not. It is also important to consider the length of time it takes to complete the actions.

Activity 1 Managing risk through actions

Allow approximately 15 minutes

In this activity imagine you are in the role of an organisation that makes their own product and has a factory within their operations that produces these products. The factory contains a single special process line that is essential to the production of the finished product. The original introduction of the special process was a significant capital expenditure for the organisation. The organisation has already identified that the loss of the special process line is a significant business continuity risk and has identified some actions that could be undertaken to mitigate the risk. The organisation now needs to consider each of these actions in terms of risk reduction (probability and impact), the cost of implementation and the time it will take to implement.

Consider the actions associated to managing this risk. First, place the actions on a grid evaluating time (to implement) and cost to deliver the action.

Discussion

Now consider how each action reduces the probability and impact of the risk.

Discussion

Much of what has been covered in the previous activity can be summarised in something often referred to as a risk burn down or waterfall chart, named after the waterfall shape the chart normally depicts. This chart, in its most often used form, has time on its x-axis and either financial risk measures or organisation risk scores on its y-axis. The chart then shows the current risk and all actions represented as steps down the waterfall as each action reduces the risk until the residual level of risk is reached. The chart can also show the target level of risk (as a gap to the residual) and potentially be adapted to show previously implemented controls, (something covered later in this session) to demonstrate the gross risk.

Figure 4 Risk burn down

It also needs to be considered what confidence you have that the actions will be done and will achieve their desired result, and you should adjust your plans accordingly.

Building risk treatment actions into other work plans and budgets is a powerful way to make sure that they don’t get overlooked. In many organisations risk treatment actions that are not planned and funded don’t happen. If treatment actions are not funded or resourced it is unlikely that they will happen.

Your residual risk level potentially tells you nothing about when this level of risk will be achieved or how confident you are about achieving it – without these two key pieces of information it should be treated with caution. In particular it should not be used in isolation for risk reporting, which is considered in Session 7, or for financial planning.

Managing actions is an integral part of any risk review process and should be aligned with the SMART objectives outlined above.

4.1 Assessing action effectiveness

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Actions are an important tool to reduce the risk level being faced. Where actions are used it is important that they are effective.

An effective action will generally have the following characteristics:

It will be targeted at one (or more) root cause(s) (or consequence(s)) and will reduce the likelihood and/or the impact of the risk by a quantifiable amount.
There will be evidence to show how this reduction has been achieved, ideally supported by performance measures.
The action will also have been delivered in full and will have been delivered on time.

Actions that fail to deliver the promised reduction in risk level or take longer than promised would be deemed to be ineffective.

In certain cases the action may result in new controls being introduced. In these cases the effectiveness of the new controls should also be assessed (see Section 6 in this session on control effectiveness).

5 Mitigation through controls

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Unlike actions, controls are a repeatable activity that, when designed and working correctly, maintain the level of the risk at its current level. However, when a control is not designed or operated correctly the level of risk will increase.

Controls and actions are therefore used in tandem: actions are used to reduce the risk level and controls are used to keep the risk at the new, lower level. Many risks never go away so the only way to keep the risk level within appetite is by using controls.

Not all controls are equal: they have different ‘strengths’ and operate on different parts of the risk. Some controls prevent the root causes from happening, whereas others reduce the consequence(s) once the event has occurred.

5.1 Elements that make a control

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

A control has the following characteristics:

It understands what is the standard is and ‘detects’ it.
It measures performance, what it is actually happening, and can interpret compared to the standard.
It takes action or feeds back to stop differences to the standard occurring or corrects the situation back to the standard.

Therefore, for a control to operate it must have the following phases:

Table 2 Phases

Phase	Description	Day-to-day example	Operational control	Financial control
Detection	There must be a method for the control to detect that a root cause is emerging or an event has occurred.	A fire alarm system needs call points, smoke detectors and/or heat detectors.	Customers report problems with a product.	Employee submits a claim for expenses and accompanying receipts.
Interpretation	There must be a method for the control to interpret the information received during the detection.	A sensor will inform the fire alarm system, which will sound a siren as a result of a ‘detection’.	An organisation subject matter expert investigates, gathers further information and reaches a decision.	Initially employee’s manager approves the employee’s expenses. Periodically expenses are reviewed for anomalies by the finance manager.
Action	There must be an action, one that is repeatable, arising from the interpretation.	The resultant siren should trigger a fire procedure that will include an evacuation of employees/visitors and summoning of the emergency services.	The organisation acts, which may result in a product recall, communications to notify customers and modification of the production process to prevent re-occurrence.	The finance manager is independent of the manager and employee. She may detect anomalies in submissions that could indicate fraudulent activity and collusion between the two employees.

When documenting a control you should capture six key pieces of information:

Table 3 Key pieces of information

Information	Definition
Why is it there?	What is the control there to do, in the most simplistic terms.
Who owns the control?	In organisations (particularly large organisations) it is important to understand who owns (or is accountable for) a control, to be able to recognise the source of expertise in relation to the control. The person is responsible for the design of the control and, to some extent, supporting the successful operation of the control.
What, When and How?	Explain the control in terms of detection, interpretation and action. Explain when the control operates: if it is continuously ‘on’, does it only operate at a set time frequency? Explain how it does what it does.
What happens if errors or omissions are identified?	If the control detects a problem or issue, how does it respond? This is a specific focus on the action phase in the event of a failure being found and confirms whether the control will act against the failure.
Levels of tolerance	What level of imperfection is allowed? E.g. if a machine was counting pennies, how many can it miss in £1,000,000?
How is a control evidenced?	The information (evidence) that the organisation retains to demonstrate that the control has been operated. In some regulated industries there may be a legal requirement to retain certain documents to demonstrate that a control has been operated.

Activity 2 Elements of a control

Allow approximately 15 minutes

Look at the information about a control and highlight where the six key pieces of information can be found.

Here is a model control statement; identify the six elements of a control in this statement.

To ensure that changes to Customer Pricing Master Data are accurate and appropriately authorised the Pricing and Revenue Manager will receive XYZ document, and approve its suitability against the prices included for the customer against the forecast and supporting information before approving by signing the document and forwarding this onto the Data Entry Team. If the Pricing and Revenue Manager does not approve any data item, the Data Entry Team will send it back to the Key Account Manager. Evidence of the control being performed is the signature on the data entry sheet held by the Data Entry Team. Try constructing the sequence of the control yourself by dragging each part of the sequence into the correct box.

Remember to open the interactive version in a new window or tab, and it is recommended that you complete this activity using a laptop or PC, rather than a mobile device.

5.2 Different types of control

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Let’s look at the different types of controls that can be used for risk treatment.

Figure 5 Types of control

Skip transcript: Video 2 Controls and actions working in tandem

Directive controls give direction. These are the weakest controls. Things like policies are directive controls; they state the practice to be followed but do not stop bad practice from occurring. The Highway Code is an example of a directive control.

Detective controls aim to identify a breach after the event, an example being a financial review or audit after activity has taken place. They will often lead to corrective action being taken.

Preventative controls act to nullify the root cause and thus prevent the event. These are often the strongest controls. Common preventative controls include segregation of duties and IT passwords.

6 Control effectiveness

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Control effectiveness must be tested in two dimensions:

Is the control designed effectively?
Is the control operating effectively?

It is important to make sure that the control is still working in the way that was originally intended. Because of this it is good practice to have assurance over controls. This is where people check that the control is designed and is operating as intended. It is also good practice to periodically review incidents (risks that have occurred) to see whether there are any other root causes that have occurred or haven’t previously been identified, and whether the controls really are operating as intended. If control weaknesses are found then a higher level of risk than expected is being taken. This activity can be seen as testing control effectiveness.

A control must firstly be designed to be effective, in that its phases should act as intended on the root cause, the event or the consequence. If the control is not designed correctly then even if operated effectively it cannot effectively manage the risk. For example, if a fire alarm only has smoke detectors fitted on one side of a building, it will fail to detect a fire on the other side of a building as a result of control design.

If designed correctly then the control must be operated effectively. The control in its operation in the organisation, deployed as per the design, provides the required action on the root cause, the event or the consequence to be effective in operation. In the case of the fire alarm, if smoke detectors were fitted but were disconnected from the electricity supply or had their batteries removed then they would fail to operate in the event of a fire.

To test effectiveness the organisation must seek to answer two questions: have the controls been designed effectively, and is the organisation operating these controls effectively?

More mature organisations will understand the cost of running and assuring a control and be able to compare it to the reduction in risk and incidents. They are then able to perform a cost–benefit analysis for their controls.

6.1 Testing control effectiveness

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Testing design effectiveness usually requires a systematic review of controls to decide whether there is an issue. Typical tests would include: reviewing the design documentation to look for potential gaps or errors; inquiry of management or subject matter experts; and observation of the process or control environment.

Testing operational effectiveness involves reviewing the activity within the organisation at its point of use. Typical tests would include: re-performance of the control; review of documented evidence of the control operating at a specific time point; or inquiry of management or subject matter experts.

7 Human factors as a controls weakness

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

When designing a control it is often important to think about the factors that could affect it working correctly or how the control could be bypassed or circumvented.

As with other areas of risk management mentioned previously, human factors can impact control operation. Controls that require people can often be less effective if people are:

not trained correctly
tired
under the influence of drugs or alcohol
over-worked
distracted.

For this reason there is an increasing trend to automate controls. In fact, in many high-hazard industries there is a control hierarchy, where automated and human controls combine. In such industries mathematical models and calculations are often performed (and required by regulators) to demonstrate that the controls reduce the probability of the risk down to a level that is ‘as low as reasonably practicable’ (ALARP).

Activity 3 Managing risk

Allow approximately 10 minutes

Consider how manage risks are managed through controls.

Recall the special process organisation example. The action plan is complete but how is the risk maintained? You have already completed the six control items for:

machine health monitoring
quarterly emergency response exercise
shop-floor IT audit.

Now it is your opportunity to complete this for operator maintenance training.

Table 4 Operator maintenance training

Information	Machine monitors	Exercises	IT audit	Training
Why does the control exist?	To provide monitoring of the maintenance status of all shop floor machines.	To provide the organisation management assurance that the organisation can respond in an emergency.	To ensure all devices within the shop floor meet the current IT security standards.	Table 4 Operator maintenance training 1
Who owns the control?	Head of maintenance	Head of health and safety	Head of IT	Table 4 Operator maintenance training 2
What does the control do?	For connected machines it provides a warning indicator in the maintenance office of any machine that is outside its specified maintenance parameters. Operatives in this area must then attend this machine and resolve the issue highlighted in line with the maintenance policy and instructions for that machine.	Exercise the organisation emergency response plans to ensure that employees and processes act as expected. Any issues found should lead to a rectification plan to fix the issues.	Audit undertaken by members of the IT team to understand what devices are within the shop floor and whether they are currently up to date with IT security standards. Non-compliant items are either rectified or quarantined.	Table 4 Operator maintenance training 3
When?	Continuous monitoring	One exercise per quarter, each in a different part of the organisation.	Normally annual but may be on an ad hoc in response to an incident.	Table 4 Operator maintenance training 4
How?	The machines’ alerts are either hard-wired or connect via Wi-Fi to terminals in the maintenance office. When an issue is detected it sounds an alarm and sends an alert to team members.	A member of the H&S team launches the exercise and records how the organisation responds against what is planned.	Normally done remotely by the IT department, however for some older hardware this may require a physical audit.	Table 4 Operator maintenance training 5
What happens if errors or omissions are identified?	Operatives from the maintenance team should rectify issues.	The H&S department provide a report to the organisation management team highlighting any issues encountered. This provides recommendations that the organisation management ensure are implemented.	Non-compliant items are either ‘fixed’, quarantined to decide next steps or removed depending on the item, its business criticality and severity of the issue found.	Table 4 Operator maintenance training 6
Levels of tolerance	Machines are classified by their criticality to the process. Each level of criticality has an associated level of response and maintenance, for example some low-criticality machines do not require an immediate response.	Recommendations are classified as major and minor. It may be acceptable for some minor recommendations to be left open.	All hardware in use must meet the required standard, there is no allowance for non-compliant hardware.	Table 4 Operator maintenance training 7
How is a control evidenced?	The system is documented within the IT department’s manual. Work carried out in response to alerts is shown in the Maintenance department’s job log.	All exercises are documented with the H&S department.	IT documents the audit and their findings. The business area document follow up remediation with IT.	Table 4 Operator maintenance training 8

Interactive feature not available in single page view (see it in standard view).

Now take a look at the following videos, looking at controls and actions working in tandem, and mitigating controls.

Download this video clip.Video player: Video 2 Controls and actions working in tandem >

Video 2 Controls and actions working in tandem

Transcript: Video 2 Controls and actions working in tandem

INSTRUCTOR

We have now looked individually at how actions and controls treat or mitigate risk. However, this is not the complete picture. To effectively mitigate risk, both actions and controls must be used together systematically to achieve the best outcome for an organisation.

To explain this, let's look again at the probability impact diagram, PID. As previously discussed, every risk has a place or risk level on the PID, which is a combination of its probability of occurring and its impact to the organisation. If we assess that we need to treat the risk, we can take an action that will reduce the impact of the risk, or we can take an action, which will reduce the probability of the risk.

In either case, we arrive at a new risk level that is either a low probability of the risk occurring or a lower impact if the risk should occur. We may choose to take both actions or have an action that reduces both probability and impact. In such cases, we will need to understand where the new risk level is for the combined actions.

At this stage, let's keep this simple and remember that any action gives us a new risk level. However, over time, the new risk level can erode. Changes made by the action can be reversed. And the risk level can ultimately drift back to its original position.

It is at this point where controls come into play. Controls are the repeatable activities that ensure that actions that have been implemented are sustained. Controls prevent the reversal of good practise by preventing organisations from deviating from solutions that they have created to prevent unwanted risk from occurring or reoccurring.

Let's use a real life example to illustrate this. Consider the risk of fire in your work environment, whether it be an office, shop, factory, or other location. There'll be a gross and current assessment of the risk of fire where you work. If you work in a location that holds stock or inventory, these items may alter the assessment of the fire risk.

Large quantities of certain materials will support the rapid spread of a fire with the potential to increase the overall size of the fire and the impact of that fire. The loss of large quantities of inventory in a fire could also have a cash impact on the business, especially if not all of the stock was covered by an insurance claim. A company might then, in an attempt to reduce its fire risk, set stock levels and work down access until it had reached those targets.

Alternatively, a workplace may use flammable materials in various locations. These materials will support a source of ignition that otherwise would not result in a fire. To reduce likelihood of flammable materials coming into contact with a source of ignition, the workplace management undertake, an action to review all flammable materials to see if alternatives can be used. In doing so and removing some flammable materials, the probability of fire is reduced. Both of our actions will result in a new risk level but without any controls.

If no one is monitoring the stock levels to check if they are in line with what was agreed, then these levels may increase. For example, if a large order is won, holding more stock may be one way the company chooses to meet demand. Similarly, if no one is checking the materials used in the processes, it is possible that new flammable materials are brought into the workplace, perhaps because the new materials are not achieving the desired results or insufficient design of the process has taken place.

In either case, the risk could move from what the planned actions had achieved to a new risk level, and importantly, often without the company's awareness that this has taken place. However, with controls, this situation is avoided. A stock control process, which flags when the stock levels are likely to exceed, set limits, and provide some efforts to get back in control will stop stock from exceeding set levels.

An approval-and-change process for all processes or activities carried out in the workplace controls what flammables are allowed in the workplace and defines how these are managed. We should maintain a probability of ammunition source and the flammable coming into contact and the desired level for the workplace. Hence, actions are necessary to reach the desired level of risk. But controls are equally important in ensuring that the risk remains at that set level.

End transcript: Video 2 Controls and actions working in tandem

Show transcript|Hide transcript

Skip transcript: Video 3 Mitigating controls

Video 2 Controls and actions working in tandem

Interactive feature not available in single page view (see it in standard view).

Download this video clip.Video player: Video 3 Mitigating controls >

Video 3 Mitigating controls

Transcript: Video 3 Mitigating controls

SPEAKER 1

90% of risk in any organisation are known risks. They're not new things. They're known risks. And at some point in the past, they will have been- the risk would have materialised, and something bad would have happened, and some control will have been developed in order to mitigate that risk.

So your internal control framework, at whatever level it is, whether it's high-level controls or operational controls- they're all there for a reason.

SPEAKER 2

So an internal control is just a repeatable action or activity, something that happens over and over again. So a great example of that, for me, would be when I- a long time ago now, when I was a student, I worked in a soap factory. And one of the things that the soap factory had to do was to make sure that there weren't any defective bits of soap.

They started off by employing some unfortunate lady or gentleman who had to physically look at each bar of soap and check that they were actually of the right size and colour. What they did to test whether that was working at one point is some ingenious person put a piece of coal on the production line to see whether the person would spot the piece of coal from the piece of soap. And they couldn't, because they'd been looking at that many bits of soap. They'd gone soap blind, if you like.

What they then did is they put in place something that was more robust to stop bits of coal getting mixed up with their soap. So for me, an internal control is something that takes a repeatable action to make sure you achieve your objective. So in my soap example, you're not getting pieces of coal in your shower in the morning. You're using pieces of soap.

SPEAKER 3

Internal controls are a vital part of risk management, and they ensure that our risk levels are accurately assessed and remain in control, ultimately. Action plans are all good and well for reducing the level of risk, but actually monitoring the level of risk is what controls are there for. If our controls fail, our risk level may increase beyond what we think is acceptable. And controls themselves are generally a repeatable action that you will continue to do maybe month by month. They could be automated, or they could be a human-type control.

SPEAKER 4

So internal controls are important because in essence, whatever you're trying to achieve is a journey. You're trying to get to the end goal, the finish line. And you'll travel a road to get there. Now, sometimes that road will be bumpy. Sometimes it will be smooth. Sometimes it will be wide. Sometimes it'll be twisty and turny.

But you've got to go across the road. You've got to get- that's how you get to the end result. And what internal controls are- internal controls are the signposts that say slow down here, bends ahead. The safety barriers are the side that stop you driving off.

Now, that's not to say that, in essence, you might drive right instead of left, you might drive too fast or too slow and do yourself an injury of some sort. But what they do do is they will get you there. The reality of it is no internal control is perfect. They have a wide remit they have to cover anyway. But if you follow those, you will get to the end result, which is the important thing.

End transcript: Video 3 Mitigating controls

Show transcript|Hide transcript

Skip transcript: Video 1 What does good risk management look like?

Video 3 Mitigating controls

Interactive feature not available in single page view (see it in standard view).

8 This session’s quiz

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Check what you’ve learned this session by taking the end-of-session quiz.

Session 5 practice quiz

Open the quiz in a new window or tab then come back here when you’ve finished.

9 Summary of Session 5

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Session 5 covered the area of risk management that is considered to provide the greatest benefit to the business: risk treatment. This session initially covered the treatment strategies available: accept, reject, transfer and mitigate. You then focused on mitigation and looked at the main areas of activity: implementing actions and operating controls.

The remainder of the session looked at how to review and assess the effectiveness of the actions and controls – a process that is essential for providing confirmation to organisations that its risk management systems are robust.

The main learning points that have been covered in this session are:

an overview of treatment
treatment strategies
an introduction to mitigation through action
knowledge of an introduction to controls
assessing treatment effectiveness
an example of a treatment plan.

Introduction

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

So you’ve identified your risks, assessed them and developed a treatment plan with actions and controls. But if that is where you leave it then you have only really covered the basics.

As discussed in Session 5, risk management is all about taking action. The actions may be specific one-off activities that reduce a risk (its impact and or probability) or they may be performing a control that keeps a risk at an agreed level.

But risk, like life, is continually changing. New root causes emerge for existing risks, new risks emerge and old risks become less material or disappear completely. Sometimes best-laid plans don’t deliver the expected results. Sometimes things that weren’t anticipated do happen.

Your approach to risk needs to respond to these changes. Regular risk reviews act as a feedback loop to all of the other parts of the risk process, making sure that you learn and continually improve. Reviews make sure action is taken to treat risks and ensure the treatments are effective. Risk reviews are the fundamental way in which risk changes are responded to.

Monitoring and reviewing look to answer the following key questions:

Is the organisation taking the right risks?
Is its risk management effective?
Is it delivering the desired results?
It is providing useful, timely information that helps improve the organisation’s decisions?

Download this video clip.Video player: Video 1 What does good risk management look like? >

Video 1 What does good risk management look like?

Transcript: Video 1 What does good risk management look like?

SPEAKER 1

So good risk management is really about are we taking specific, timely action on the risks that we've identified to allow us to achieve the results that we set out to do.

SPEAKER 2

It's always difficult to tell if you're doing good risk management, because a sign that you're doing it well is that you don't have incidents, and things don't happen.

SPEAKER 1

Is there a regular review of those risks? So it's not about having, maybe on Friday afternoon- what are the risks this week? It's actually about trying to build it into the everyday conversations so that it becomes part of how we set out to manage businesses.

SPEAKER 3

In certain organisations, you often hear the phrase "we weren't aware that that was happening" or "we didn't know about that." so part of good risk management is about making sure that there isn't anything that's going to catch you unawares.

SPEAKER 1

Are the actions that are being taken actually helping to reduce the risks?

SPEAKER 4

It isn't about ticking boxes, filling in forms, and having reports. There's a reason why we do that, but that isn't risk management. That's just risk reporting.

SPEAKER 5

Less things will go wrong because I do cognisant decisions right at the front, so going, OK, this could happen, so I put countermeasures in place. Or I say this could happen, and I would be OK with that happening. So I actually say- I take that money aside or whatever because I can accept. I can live with it. So eventually, I will see less surprises, less incidents, things that hit me unprepared.

SPEAKER 6

I would say good risk management is happening when issues that might affect an organisation are being raised comfortably, confidently, early as well.

SPEAKER 4

If you hear, in conversation, people challenging assumptions, and conversing about risk, and asking probing questions, and trying to understand what could go wrong, what needs to go right, what are the things we've got in place- it's all around conversation. That gives me an indication that an organisation and people within the organisation kind of live and breathe and really understand what the purpose of risk management is.

End transcript: Video 1 What does good risk management look like?

Show transcript|Hide transcript

Video 1 What does good risk management look like?

Interactive feature not available in single page view (see it in standard view).

By the end of this session, you should be able to:

understand the value of monitoring and reviewing risks
understand what a risk review is
understand what takes place during a risk review
understand the basics of risk assurance (including the three lines of defence concept).

Now begin Session 6.

1 Are the right risks being taken?

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

It is essential for organisations to review their risk management practices periodically – and certainly at least annually. This allows those responsible for risk management to check that the methodologies and policies adopted remain appropriate. It also enables consideration of whether the right risks are being taken in the business – while other risks which do not need to be taken are controlled or mitigated. The business and economic climate within which organisations operate change over time and, if only for this reason, regular reviews of risk strategy are an integral part of good management.

The next three sections examine different approaches that can be taken when reviewing an organisation’s risk strategy.

1.1 Risk reviews

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Risk reviews look for new risks and new root causes; they look to share learning, best practice and incidents to inform the other parts of the process.

Risk reviews follow the same basic pattern as other meetings. They should have an agenda and a terms of reference. Participants should be engaged in the subject matter and not continually distracted.

Like many other meetings, most of the real value happens before and after the meeting. Before the meeting risk owners should be clear on their risks, their assessment, what treatments are in place and whether these treatments are effective.

A good meeting is also clear on why the information is being provided – is it to inform or is it so a decision can be made? If so what decision is required, why and why now?

Risk owners should make sure that the treatments are working, that assurance is taking place and that they are learning lessons from incidents.

The paradox of risk management, which is particularly apparent in reviewing risk, is that if done well it is rarely visible, but if done poorly this becomes all too apparent to the wider organisation.

Activity 1 Examples of good and bad risk reviews

Allow approximately 10 minutes

Look at the statements relating to risk reviews and decide which are ‘good’ and which are ‘bad’ for risk review quality. Select from the drop-down lists.

Active content not displayed. This content requires JavaScript to be enabled.

Interactive feature not available in single page view (see it in standard view).

1.2 Risk key performance indicators (KPIs)

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Good risk review meetings often look to key performance indicators (KPIs) to help inform the debates and discussions.

There are many risk KPIs: some measure the process, some measure the result, some measure the amount (or value) at risk. Others look to be leading indicators predicting the direction of travel that a risk is likely to take. The key thing is to have a range of metrics that cover the breadth and depth of activity. Here are a few of the common areas to measure:

Table 1 KPIs

The amount of risk being taken	Value at risk (see Session 4) Risk profile and details of any risks out of appetite
Change of risk level	Key risk indicators (KRIs)
Risk treatment compared with plan	Amount of risk reduction achieved (compared to plan) Performance of controls (e.g. internal audit and other assurance findings) Timely completion of mitigation actions
Compliance metrics	Completion of risk training Compliance with risk management policy and other directives
Coverage metrics	Areas of the organisation performing or not performing risk management
Measure of incidents	Incidents (and re-occurring incidents) Health and safety performance (e.g. HPI (or fatality rates) per million working hours)
Maturity	Is the approach to risk management comprehensive and effective?

1.3 Deep dives

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Some companies perform a ‘deep dive’ into selected risks. A deep dive is an opportunity for the attendees to understand the risk in more detail, to get a more in-depth view of the causes and consequence, and to add their perspective, providing an opportunity to highlight any areas that may have been missed and test the thinking and assumptions. It can be a good way to avoid blind spots.

The risk(s) chosen do not need to be highlighted by the exception report (i.e. the risk has failing controls or overdue mitigation actions). Instead a deep dive is an opportunity for the panel to review treatment activities (actions and controls) and make sure that they are confident the risk is being appropriately managed. It is also a good opportunity to reinforce the tone from the top that risk management is important and valued.

Some companies focus their deep dives into areas with a known problem or where incidents have occurred. These deep dives primarily focus on helping the area to improve.

Take a look at seven key questions to ask in a deep dive.

2 Is the risk management effective?

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

A further aspect of the periodic reviews of risk management within organisations needs to focus on the effectiveness of the controls in place which aim to ensure that risk policies are adhered to. Without good controls even the most sophisticated risk management policies risk being impaired.

2.1 The role of risk assurance

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

A key question that needs to be asked of any system, not least a risk management system, is, ‘How do you know it works?’

A variety of different approaches can be taken. For example, you could ask:

Is the risk level reducing?
Are the internal controls being audited and attested to?
Is risk training being completed?

Some people go further by measuring maturity while others measure the nature and impact of incidents that have occurred.

There is no right or wrong answer as long as you know your risk management system works and you can prove it. One way that organisations offer this proof is via a three lines of defence approach.

2.2 Risk and assurance – three lines of defence

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

To ensure the effectiveness of an organisation’s risk management framework, the board and senior management need to be able to rely on adequate line functions – including monitoring and assurance functions within the organisation. The Institute of Internal Auditors (IIA) and the Institute of Directors (IoD) endorse the ‘three lines of defence’ model as a way of explaining the relationship between these functions and as a guide to how responsibilities should be divided. This model is broken down as follows.

The first line of defence – functions that own and manage risk. Under the first line of defence, operational management has ownership, responsibility and accountability for directly assessing, controlling and mitigating risks.
The second line of defence – functions that oversee or specialise in risk management and compliance. The second line of defence consists of activities covered by several components of internal governance (compliance, risk management, quality, IT and other control departments). This line of defence monitors and facilitates the implementation of effective risk management practices by operational management and assists the risk owners in reporting adequate risk-related information up and down the organisation.
The third line of defence – functions that provide independent assurance. An independent internal audit function will, through a risk-based approach to its work, provide assurance to the organisation’s board of directors and senior management. This assurance will cover how effectively the organisation assesses and manages its risks and will include assurance on the effectiveness of the first and second lines of defence. It encompasses the entire framework, the operation of the framework and the coverage and all categories of organisational objectives.

Figure 1 Three lines of defence model

3 Risk-based assurance

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

The term ‘assurance’ refers to checking and testing, that the oversight that should be happening is happening. People who conduct assurance can often go under the generic title of ‘auditors’. Auditors generally look for evidence that such activities are taking place.

Best practice is to have assurance activities focused on your risks – but what does this mean in practice? In the following sections you will look at how the facets of the control framework should be audited. This audit has certainly got to extend to reviewing the potential impact of behavioural weaknesses amongst employees and ensuring that these do not impair effective risk management.

You can recap the purpose of actions and controls in Session 5, Video 1.

3.1 Controls

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

The more important each control is (i.e. the bigger the level of risk reduction it achieves) the more important it is to have assurance. Assurance of controls should look at both the design (does the control, as designed, reduce the probability or impact of the risk?) and also the operation (is the control operating in the way the design intended?), to confirm that both are effective.

There is a ‘many to many’ relationship between risks and controls. This means that each risk could have several controls related to that risk, but also one control may mitigate several risks. Controls are often embedded in processes. Organisations often get assurance over their controls by auditing their processes. When identifying their key controls, organisation should also consider situations where they are reliant on a single control.

Activity 2 Risk/control matrix

Allow approximately 10 minutes

One way to manage the ‘many to many’ relationship is by using a risk/control matrix.

Click on the interactive to start selecting your answers from the drop-down options.

3.2 Mitigation actions

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

The more important each action is (i.e. the bigger the level of risk reduction it achieves) the more important it is to have assurance. Assurance of actions should look at:

the effectiveness of the action in delivering the promised risk level
the ability of the organisation to fund and deliver the action
the timeliness of the action in respect to the risk (i.e. there is no value delivering an action after the risk is likely to have impacted)
the level of risk reduction achieved for the amount spent on delivering the action (i.e. if the action costs more than the impact of the risk then it is unlikely to be a suitable course of action).

3.3 Risk framework

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Assurance here takes the form of coverage – whether the risk framework covers the entire organisation, whether it addresses all of the areas of risk and whether all the elements of risk framework are present (see the diagram in Video 5, Session 2).

Assurance over the risk framework can often be overlooked but is very important. Assurance is often conducted by the third line of defence and looks at both the design of the framework as well as its implementation.

3.4 Human factors and internal controls

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Internal controls are a widely used component of most risk management systems. But controls that rely on people can sometimes fail.

Of a more sinister nature, deliberate deception or fraud can cause an otherwise high-performing risk management system to fail. Failing to identify risks or to properly assess them, or deliberate subversion of controls for fraudulent purposes, can lead to a risk system failing to operate correctly – fraud effects all organisations, to a greater or lesser extent, and it is something that should be guarded against.

To guard against an individual committing fraud it is common to have ‘segregation of duties’ – this simply means that more than one person is involved in carrying out a task. An example is paying a supplier. Segregating duties would involve one person raising the invoice and another person paying the invoice. Segregation of duties can be subverted (got around) when people collude. For this reason an independent oversight (e.g. by internal audit) is necessary, even when, at face value, appropriate controls are in place.

3.5 Antidotes to behavioural issues

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

To conclude this review of the matters that need examining in an audit of risk management systems have a look at this list of recommendations for controlling (and hopefully containing) the potential adverse impact of behavioural issues.

Learning from history.
Reporting incidents.
Incentives – for example, personal objectives regarding ethics and compliance, or rewards to whistle-blowers who identify frauds. These are common in the US with the whistle-blower receiving a proportion of any fine subsequently handed down.
Incentive system designed to remove conflicts (e.g. production rate v. quality rate, sales targets v. bribery).
Not doing risk reviews in a group but in independent one-to-one sessions.
Reviews and assurance conducted by third parties (and without notice).
UK government approach to horizon scanning and risk assessment (futures toolkit).

4 This session’s quiz

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Check what you’ve learned this session by taking the end-of-session quiz.

Session 6 practice quiz

Open the quiz in a new window or tab then come back here when you’ve finished.

5 Summary of Session 6

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

Session 6 has looked at monitoring and risk reviews. You have considered why you need to monitor and review risk activity, and you were introduced to the three lines of defence model as best practice to structure the monitoring and review activity.

You then looked at some tools to support monitoring activity for risk management, discussing the use of risk KPIs and the concept of a deep dive to ensure the right information is reviewed for risks and that those risks are ‘brought to life’ for those involved in their management.

Finally in Session 6, you looked at risk-based assurance and considered an overview of what would be expected from any risk-based assurance activity undertaken in an organisation as part of risk monitoring and review.

The main learning points that have been covered in this session are:

the value of monitoring and reviewing risks
what a risk review is
what takes place during a risk review
the basics of risk assurance (including the three lines of defence concept).

Introduction

The Open University — Mon, 04 Nov 2019 10:53:14 GMT

In response to a number of high-profile corporate failures (Enron, WorldCom, etc.) regulators have introduced standards that apply to large listed companies. References to risk management are commonly contained in listing rules or agreements (India, UK and US), company laws (Austria, Germany, Turkey and Japan), or stock exchange laws (Mexico).

Figure 1 ISO 31000 diagram – communication & consultation and recording & reporting

Skip transcript: Video 1 Good risk management

Download this video clip.Video player: Video 1 Good risk management >

Video 1 Good risk management

Transcript: Video 1 Good risk management

SPEAKER 1

So good risk management is really about being very clear on what objective is that you're trying to strive for and think about the risks that relate to that objective.

SPEAKER 2

Good risk management is beyond creating your risk register. It's all about making sure we've got good action plans and treatment plans and controls in place to manage that risk and prevent it going out of control, ultimately. But it also goes beyond the process. So there is-- it's all about getting everyone involved and risk management, from the boardroom down to your apprentice on the shop floor, making sure everyone has the skills necessary to manage risk together as a group.

SPEAKER 3

Good risk management is incredibly simple. I'm a pragmatic sort of person. I like a pragmatic approach. And where you have organisations that employ thousands of people, or in my case, tens of thousands of people, it can be very difficult to actually have a one-size-fits-all approach. So for me, it's distilling it down. It's taking it to the masses.

And so by doing this, it quite simply comes down to good identification. You identify a risk. Seeing it in the first place, you've got to be actively looking. You've got to have that feeling in place that I'm happy to come forward with that information in the first place. Then they'll know who to speak to about risk or to raise that risk with them.

And then work with that person to make sure that other people can understand it so other people can be-- you know, good risk management is a community effort. It's not just me sitting in a room somewhere typing something up or thinking of something great to put in a report. It's none of that. It's all about conversation. It's communications.

SPEAKER 4

You cannot do everything, so don't try to overcook it. It's really make sure you are aware of what are the significant, material things that can work to your disadvantage or to your advantage. And make sure you address them as part of your plan of what you actually want to do. And then there is, strictly speaking, no risk management. it's basically executing a robust plan.

SPEAKER 5

For me, good risk management looks like something that you cannot see. I think if it's effective, it's not making too much of a noise. It's going on in the background. It's part of people's routine activity. It's something that I think everybody should be involved in, but I think it's something that should be part of core business operations.

SPEAKER 1

And other reasons that it's important is it's actually one of the things that needs to be done under UK corporate governance regulations. And that's something that's been in place for UK companies for a number of years now. And one of the requirements is to have what's known as a risk management system in place to make sure that, again, the company is doing everything it can do to be successful and to think about anything that might happen that could cause it not to be successful.

End transcript: Video 1 Good risk management

Show transcript|Hide transcript

Skip transcript: Video 2 History of the UK Corporate Governance Code

Video 1 Good risk management

Interactive feature not available in single page view (see it in standard view).

Additional guidance that is sometimes provided, such as the UK’s ‘Turnbull Guidance’, mainly refers to audit and internal controls. One exception is Singapore’s Corporate Governance Council, which in May 2012 issued guidance specifically on the governance of risk management (‘Risk Governance Guidance for Listed Boards’).

Download this video clip.Video player: Video 2 History of the UK Corporate Governance Code >

Video 2 History of the UK Corporate Governance Code

Transcript: Video 2 History of the UK Corporate Governance Code

NARRATOR

The UK corporate governance code has to date been updated in responses to high profile failures in corporate governance. The first version of the code was published in 1992 by Sir Adam Cadbury, known as the Cadbury Report. The report was commissioned following a number of high profile corporate scandals in the UK, mainly involved in fraud such as Polly Peck, BCCI, and Robert Maxwell.

The major principles covered separation of the CEO and chairman roles, appointed of non-executive directors and formation of an audit committee attended by non-executive directors. In 1994, the principles of the code were appended to the London Stock Exchange's listing rules. All listed companies were required to comply with the principles or explain why they did not.

Public outcries over executive pay of recently nationalised firms led to another code being introduced, the Greenbury Report. This introduced additional principles where a remuneration committee set executive pay and executive pay linked to long term performances were introduced. In 1998, these two codes were brought together to form the combined code.

Over the next decade, further updates were made in response to corporate failures, such as Enron, Northern Rock, and the banking crisis with the combined code renamed as the UK corporate governance code. In the last decade, code has been updated three times with the aspiration to increase boardroom accountability and increase trust in the business.

End transcript: Video 2 History of the UK Corporate Governance Code

Show transcript|Hide transcript